Prohibit non-IMMUTABLE functions in multi-shard SELECT queries

Though all (non-side-effecting) functions are safe to execute in a single-shard `SELECT` query, the same is not true for multi-shard SELECTs. In particular, a function such as `random()` or `now()` would return a different value for each shard and so the query results would not represent a consistent view of the world.

This may overlap somewhat with #47, but that issue is more concerned with single-shard ramifications. We've noticed this bug affects multi-shard queries as well, so they'll need similar treatment.