Bind SQL parameters in firefox bookmarksrunner support

Summary: Previously (accidental) SQL injection was easily possible.

Test Plan: Could still list bookmarks.

Reviewers: #plasma

Subscribers: plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D22623