Make all string conversion functions safer

[Andrew Hutchings]

All string functions need a max to length parameter. So:

drizzle_safe_escape_string becomes drizzle_escape_string
drizzle_hex_string adds a parameter
drizzle_mysql_password_hash adds a parameter

[Andrew Hutchings (linuxjedi)]

actually only matters for escape_string, the others have fixed return lengths. That said the return type for drizzle_hex_string only needs to be bool