Document how to use prepared statements

The client is based on Python DB-API so the usage is `cursor.execute(sql, params)`.
We use `?` for params.

So an example would look like:

```python
cursor.execute("SELECT * FROM tbl WHERE col_1 = ? AND col_2 = ?", ("value_1", "value_2",))
```

Note that `params` can either be a tuple or list.