Remove deprecated db_prepare_string() function

It was used in:

• user_set_fields() to escape the field names when building the SQL
  query to update the user data. This function is normally only used
  internally, so $p_fields array can be considered as trusted input.
• file_move_bug_attachments() to escape the file path, which is not
  necessary (parameterized query)

Fixes 0032704