Replacing unsafe sql commands in upgrade scripts

Now that the cenozo database isn't necessarily "cenozo" there were
some SUBSTRING commands in the sql upgrade scripts which were no
longer valid.  This commit replaces them with the safer REPLACE
command.