Update documentation for executeQueryWithFormat and executeUpdateWithFormat

I've tried to rectify the error I originally made in the `executeQueryWithFormat` and `executeUpdateWithFormat` documentation, in which I incorrectly assumed that these methods were effectively doing `stringWithFormat`. Thus my caveat about "beware of SQL injection" was not relevant. I also tried to add a note that attempts to explain why this isn't like `stringWithFormat` approach (i.e. you can only use it with values in SQL statements, not column names and table names; you cannot use it with `pragma`; you should not include quotation marks in your SQL like you would if you did `stringWithFormat`).

Gus, feel free to use or disregard this as you see fit. No offense will be taken either way. But the current documentation is misleading. And I think the curious behavior of these methods warrant clarification, but I'll leave that to your good judgment.

I'll send separate pull request for the gh-pages.