Use bind variables in file_add() function

Use of db_query() in file_add() is causing issues on Oracle due to the
size of literal SQL statements being limited to 2000 chars: error
ORA-01704 occurs when attaching files with DB storage. To avoid the
problem, bind variables must be used.

We now call db_query_bound() instead of db_query(), and file_add() has
been refactored to remove usage of deprecated dbprepare* functions.

Fixes 0014563