How to "analyze" a SQL query?
It's extremely hard to make this secure. Event if you are trying to be smart and check for every "possible" aspect. There is also dynamic SQL. And all kinds of ways to obfuscate code.

I wouldn't let the world run any query with more permissions than they should have.

If at all, I would create a user with restricted privileges, so that he can only do what he's allowed to in the first place. Also be aware that some database objects are visible to public by default, some tables in the system catalog like pg_class for instance ...