SOAP API: align mci_file_add() with core file_add()

Most importantly, use bind variables (db_query_bound) and remove
deprecated dbprepare* function calls.

A few other, minor changes were made to ensure mci_file_add() is as
similar as possible as the core file_add(), and the two functions behave
in a consistent way.