Quality Database Security Metrics
The only way to get to what you're looking for is through an audit process of some kind, using a pre-defined checklist like the DISA STIG or CIS or some other recognized benchmark. These will all include a variety (even a majority) of &quot;metrics&quot; about documentation and policy that can't be measured through automation, so don't think there's an easy way to do this to get meaningful results.
There are whole areas of research and organization dedicated to how to approach this on a complete infrastructure or system level, like the Risk Management Framework. There are also legal requirements to evaluate against if your system is covered by the Fair Credit Reporting Act, Graham-Beach-Bliley Act, Children's Online Privacy Protection Act, The Health Information Technology for Economic and Clinical Health Act, HIPPA, the Federal Information Security Act of 2002, or GDPR. These carry their own auditing requirements.
It's also important to recognize that a system or application's security is about all layers of that system: database; operating systems; application servers; web servers; application code; network infrastructure; storage; authentication and authorization; and even user and admin training. All must be evaluated from top to bottom to get anything close to a complete picture. Even then with these checklists all you're really demonstrating is what you've prepared for / hardened against; there's no absolute measure of a system's security, per se.