Quote range strings when quoting PG ranges (4-0-stable)

The test case for CVE-2014-3483 doesn't actually send the generated SQL
to the database. The generated SQL is actually invalid for all inputs.