.Net: [MEVD] Do a proper pass to ensure that all names are property sanitized (prevent SQL injection)

[roji]

There are some cases where we're integrating externally-provided string directly into SQL without quoting/sanitation, e.g. here. We should do a proper pass before releasing to ensure we don't do this anywhere.

/cc @westey-m @dmytrostruk @adamsitnik

[roji]

Seems like we also have some suppressions for CA2100, we should remove these.