Stop escaped hashes being picked up as risks.

Some databases (Sybase, MS SQL Server) use #tablename and ##tablename to
indicate temporary tables. Despite being correctly escaped with doubled-hashes, these were being incorrectly flagged by qpscanner.

Removing an even-numbered sequence of hashes will prevent this and any
other escaped hashes from being picked up. Whilst it will also remove some
non-escaped hashes (e.g. `#a##b#`) it will not remove all hashes, so still
ensures queries that should be flagged are.

Fixes #10 on GitHub.