libtracker-sparql: Document requirement to escape constructed queries

Bring SQL injection to the front of people’s minds when using the APIs
so that hopefully they don’t write injectable code.

https://bugzilla.gnome.org/show_bug.cgi?id=741777