Non-privileged user for most interactions

[danielbrauer]

These bits might help in the migrations, although probably best to do it explicitly:

ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${client.escapeIdentifier(user)};
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE SELECT ON TABLES FROM read_only_user;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${client.escapeIdentifier(user)};
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM read_only_user;