Add QuoteDuckDbIdentifier function and use when building queries instead of manuallu escaping column names in duck db queries

[kaidaguerre]

Also - review all duck db queries for correct escaping and to use paramaters where possible

When changing a query to use a parameter instead of sprintf - be sure to test the query runs (consider a unit test). Parameters do not work for all duckDB commands, for example COPY does not support parameters