Fix parameter handling in FunctionsBuilder (#19520)

Fix weakness in FunctionsBuilder

Several methods did not explicity label their parameters as unsafe, so
it is possible for an application developer to mistakenly supply user
controlled data into these parameters creating a SQL injection vector.

Thank you to Himanshu Anand for reporting this issue.

Backport #19520 to 4.x