[Bug Report] Query API Lacks Parameterization, Enabling SQL Injection

**Summary**
The IoT Hub C# SDK does not provide a mechanism for parameterized queries. Query strings must be built by hand, typically through string interpolation or concatenation. When any part of the query is derived from user input or an external source, this opens the door to SQL injection attacks against the IoT Hub query API. Although no data can be altered, this can be used for data exfiltration.

**Steps to Reproduce**
1. Use the RegistryManager to run a query where a value comes from user input:
```csharp
string userInput = "ModelX' OR '1'='1"; // malicious input
string query = $"SELECT * FROM devices WHERE tags.model = '{userInput}'";
var result = registryManager.CreateQuery(query);
```
2. Observe that the injected payload is executed as part of the query rather than treated as a literal string value.
3. Note that the SDK provides no alternative — there is no overload accepting parameters, no placeholder syntax, and no escaping utility.

Start at the RegistryManager.CreateQuery entry point and trace how query strings reach the IoT Hub query API. Determine the supported parameterization design and its test coverage; done means externally supplied values are treated as literals rather than executable query syntax, with the behavior verified against the injection example.

Written by the indexing model from the issue text.