Avoid possible SQL injection by refactoring string-based query construction

### Body

Some of our queries are string based, and they are passed directly to sqlalchemy `session.execute()`. To avoid SQL injection, we can profit from sqlalchemy by rewriting the queries [bind parameters syntax](https://docs.sqlalchemy.org/en/14/core/sqlelement.html#sqlalchemy.sql.expression.text) or the select API.

- [ ] Airflow Core - migration
- [ ] Airflow Core - utils
- [ ] Airflow Providers - Amazon
- [ ] Airflow Providers - Apache.Cassandra
- [ ] Airflow Providers - Apache.Hive
- [ ] Airflow Providers - common.sql
- [ ] Airflow Providers - Databricks
- [ ] Airflow Providers - Google
- [ ] Airflow Providers - MySQL
- [ ] Airflow Providers - Oracle
- [ ] Airflow Providers - Postgres
- [ ] Airflow Providers - SalesForce

### Committer

- [X] I acknowledge that I am a maintainer/committer of the Apache Airflow project.