Use db_select() in place of db_query() to work with Oracle DB driver.

This patch is a follow on to the issue described in #1451198: PDO Exception for anonymous user when user Oracle database → and #1451936: Binding parameter error with value 0 when using db_query → .

This patch replaces all calls to db_query() with calls to db_select() as appropriate. Ideally, it would be nice to see this fixed in Oracle, but until it is, this patch should allow ACL to work in that environment.

Unfortunately, I wasn't able to get the tests to run locally, so apologies in advance if this results in a mess of errors.