fix(sec): remove most instances of possible sql injection

[cpcloud]

This PR adds ruff's flake8-bandit checks and fixes the lints or explicitly
ignores them (where it's low risk or unavoidable).

Most of the work here was in building SQL using sqlglot instead of constructing
queries using format strings.

That's not 100% foolproof for cases like .sql() methods, but we're at least
covering the bases in cases where we have more control over input.

[jcrist]

Just a cursory review, honestly mostly relying on tests here to have caught any regressions.