databaseInterface: support passing argument tuples

These allow values to be passed into SQL statements without interpolating
them into the string, preventing possible SQL injection issues.
For example:

sql = """SELECT * FROM fpr_formatversion WHERE uuid='%s'""".format(uuid)
databaseInterface.queryAllSQL(sql)

Could be run as:

sql = """SELECT * FROM fpr_formatversion WHERE uuid=%s"""
databaseInterface.queryAllSQL(sql, (uuid,))

Since the values are inserted here without string interpolation, there
is no risk of quoting issues or SQL injection regardless of the contents
of the values.

Fixes #4901.
emailFailReport: don't interpolate values into SQL

The HTML document being embedded can contain single quotes.

Fixes #7208.
databaseFunctions: convert to use SQL parameters

refs #4901
createMETSRights: namespace PREMIS elements

Fixes #7210.