provTAP and PEP 249

When converting the local access of a database (directly to postgres, mysql or similar) to TAP (ADQL or native language), one runs into the problem that the TAP service does not support [PEP 249](https://www.python.org/dev/peps/pep-0249/), the Python Database API Specification, but maintains the queries in its very own way.

Apart from not using the `connection`/`cursor` classes, there is also no way to safely use variables (as in `cursor.execute()` in PEP 249); instead one has to locally create the full query and also do the required escape sequences manually. This has the danger of SQL injection, especially when the query is built using external input.

IMO pyvo should follow the Python standard for a database API here.

Start by reviewing pyvo's current TAP query interface and the PEP 249 connection, cursor, and parameterization requirements described in the issue. Define the scope and compatibility expectations for a PEP 249-style API; done should include safe variable handling and documented behavior for TAP queries.

Written by the indexing model from the issue text.