Add validation to SQL inputs for webhook and retry service.

`pkg/retry` and `pkg/webhook` doesn't yet use the improved validation added in #198

This is not a huge concern as the threat model for this particular injection risk is a privileged insider who likely already has sufficient access to the database anyways. Mainly this is to ensure that we have secure patterns so if they are copied or used elsewhere we don't accidentally introduce injection bugs.