Fix error SQL injection level 4

[r1kka6]

Replaced the Level 4 faux-parameterized lookup with a real bound parameter, and stopped returning raw database exception messages to callers.

Local verification:

• docker run --rm -v "$PWD":/workspace -v "$HOME/.gradle":/root/.gradle -w /workspace eclipse-temurin:17-jdk ./gradlew test spotlessJavaCheck bootJar --no-daemon --max-workers=1
• Baseline id=# leaked the H2 data conversion error and full query text even though a PreparedStatement object was used
• Patched id=# now returns { "isCarPresent": false}
• Patched id=1 still returns the Audi record, and id=999 returns the generic false response
• Added a regression test that invokes the captured PreparedStatement creator/setter and verifies select * from cars where id=? with setString(1, "#")