Fix false negative for SQL injection when using DB.QueryRow.Scan()

[kaiili]

Problem
fixes #713

Details :
can be seen in #713.
G201 regexp only match callexpr once.
If there is a sqlquery like the following, there will be problems with matching.

func main() {
var name string
db, err := sql.Open("sqlite3", ":memory:")
if err != nil {
panic(err)
}
q := fmt.Sprintf("SELECT name FROM users where id = '%s'", os.Args[1])
err = db.QueryRow(q).Scan(&name)
if err != nil {
panic(err)
}
defer db.Close()
}

Solution
Add an extra check befor checkQuery.

[ccojocar]

Thank for rebasing the pull request. I left a few review comments. It would be great if you could have a look at them. Please could you also check the tests, there is one test failing. Thanks again!