Feature request: Parameterised SQL queries in VTL

There is currently no way to execute a parameterised SQL query against the Aurora data API in VTL. Without this all but the most simple queries cannot be executed in VTL. While there is a `variableMap` field which looks like it should be parameterised, it simply concatenates the strings and is just as vulnerable to SQLi. There is a broad misconception about this in the community (https://github.com/aws/aws-appsync-community/issues/60#issuecomment-546791723) as this separation is the standard way of parametrising queries in all other SQL libraries (including [boto3](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/rds-data.html#RDSDataService.Client.execute_statement)).

Request - please can the `variableMap` field be converted to allow parameterised queries or a new `parameters` field be added that parameterises the query being made against Aurora.

Start with the VTL resolver path that executes statements through the Aurora Data API, then compare the requested behavior with AWS RDS Data API execute_statement parameter handling. Done means the issue's requested parameterized-query behavior is supported separately from SQL text and its SQL injection concern is addressed.

Written by the indexing model from the issue text.