custom_field_api: use db_query_bound instead of db_query

db_query() was deprecated a long time ago and has now been removed from
the API. custom_field_api was still using the old db_query() function.

This commit does not attempt to properly setup bounded queries for the
old db_query() calls. This will happen at a later stage once the new
Database API is finished.