Datasette SQL Injection Fix (1.0a38)

Datasette 1.0a38 (backported to 0.65.3) fixes a SQL injection vulnerability affecting instances that serve a mix of public and private tables in the same database using Datasette’s permissions system. Even with the execute-sql permission disabled, a user with access to any public table could exploit the bug to run SQL injection attacks and reach private tables. Site administrators serving mixed public/private tables should upgrade immediately.