feat: add query builder with escaping

[ernado]

So, instead of writing

query := fmt.Sprintf("SELECT * FROM table WHERE foo = '%s' AND bar != %d", "foo", 1234)

We can do something like

query := Build("SELECT * FROM table WHERE foo = ? AND bar != ?", "foo", 1234)

And this should be safe to use without input sanitizing.