Attempt to unify query escaping between dialects

All dialect implementations re-implemented escaping, resulting in
(roughly) the same code being written four times in the codebase. This
moves all of that into SqlString.