Always load Unconfirmed on `plugins_loaded`

Fixes situations in which Unconfirmed is required as a MU plugin, but filters need to be applied before the class is loaded. My specific situation is that I need to filter the network admin URL because of a core bug.
Fix incorrect use of `$wpdb->prepare()`

Resolves this error:

```
Warning: Missing argument 2 for wpdb::prepare(), called in /srv/www/digitalfirstmedia.dev/content/mu-plugins/unconfirmed/unconfirmed.php on line 573 and defined in /srv/www/digitalfirstmedia.dev/wp/wp-includes/wp-db.php on line 1138
```
Bump version numbers to 1.2.4
Escape search string before putting into input field

Prevents XSS vulnerability