Read a plan by its id as a parameter, never as SQL (issue 561)

PlanByID pasted its id into the query, and the id comes from a caller of
the plans verb: an id holding a quote changed the query (x' or '1'='1
answered another plan). The id is now $1, and RecentPlans's limit too, so
no plan query is built from a value.

internal/inventory/plans.go

@@ -623,7 +623,7 @@ func (i *Inventory) PlansSince(ctx context.Context, since time.Time) ([]Plan, er
 
 // RecentPlans is the last few plans, newest first, open or not — what the overview shows.
 func (i *Inventory) RecentPlans(ctx context.Context, limit int) ([]Plan, error) {
-	return i.plans(ctx, fmt.Sprintf(`order by created desc limit %d`, limit))
+	return i.plans(ctx, `order by created desc limit $1`, limit)
 }
 
 // NewestMergeOf is the plan, in any state, of the newest merge into a repository's branch that the mesh
@@ -638,9 +638,10 @@ func (i *Inventory) NewestMergeOf(ctx context.Context, repository, branch string
 	return plans[0], true, nil
 }
 
-// PlanByID is one plan.
+// PlanByID is one plan. The id is a parameter, never part of the query (novox/hq issue 561): it comes from a
+// caller of the plans verb.
 func (i *Inventory) PlanByID(ctx context.Context, id string) (Plan, error) {
-	plans, err := i.plans(ctx, `where id = '`+id+`'`)
+	plans, err := i.plans(ctx, `where id = $1`, id)
 	if err != nil {
 		return Plan{}, err
 	}