[#1725] datastore_search_sql validates being called with single statement

We're using sqlparse to actually parse the SQL string and make sure it's a
single statement. That means we can be more sure that the user is providing us
with a single statement, and we support SQL statements with semicolons, like
'SELECT * FROM "foo;bar"'.

This is a first step towards avoiding multiple statements even on
datastore_search and datastore_delete, to make our code a bit safer against SQL
Injection vectors.
[#1725] Move is_single_statement() to datastore_helpers

It was already being used by datastore_search_sql, so it isn't private. That
being the case, we'd better make it look like it's not private.
[#1725] datastore_search and _delete don't work with multiple statements

What we're trying to avoid is for an insecure extension to allow a malicious
user to create queries like:

```
SELECT * FROM "foo" WHERE (1=1); DELETE FROM "foo"; -- AND "bar"='5');
```

This doesn't avoid all possible SQL injection vectors, but it's one less issue
to worry about.