Updated security policy to reflect supported versions and reporting guidelines.

sqlite3_prepare_v2 returns SQLITE_OK with a NULL statement handle when
the input contains no SQL. exec() already handled this; query() forwarded
the NULL handle to bind(), which crashed in sqlite3_clear_bindings(NULL).

Make query() skip NULL statements like exec() does, and make SQLiteRows
safe against a nil underlying statement so the empty-rows return value
does not crash.

Closes #1390

Fix panic when querying input with no SQL (only comments/whitespace)

evict least-recently-used stmt when cache is full