sql/parse/parse.go is littered by invalid string splicing

[knz]

We see code like this:

  stmt, ⊙ ≔ ParseOne(fmt.Sprintf("ALTER TABLE %s RENAME TO x", sql))
  stmt, ⊙ ≔ ParseOne(fmt.Sprintf("SELECT fakeprefix.%s", sql))
  expr, ⊙ ≔ ParseExpr(fmt.Sprintf("1::%s", sql))

This improperly expands the SQL name as a string, and misses escaping when the name contains special characters.

There may be other occurrences elsewhere in the source tree.

Example resulting bug, found in the wild: #57187

A general fix for this would be to apply the technique that @petermattis designed for the CC code here: https://github.com/cockroachlabs/managed-service/pull/4223

[petermattis]

I noticed recently that pkg/sql/delegate contains a lot of manually constructed SQL. The instances I looked at looked safe at first glance, but I'd feel better if we had a more principled approach to SQL string construction.