Fix critical bugs in app_urls

- init_db.py: parameterize SQL queries to prevent SQL injection
- scheduled_tasks.json: resolve duplicate periodic task pk (4 -> 15)
- db_utils.py: use function parameter in _get_status_pattern_matching
  instead of capturing the enclosing scope variable
- url_detail.html: fix wrong field name image_urls -> images_url
- settings.py: align Celery queues (default/light/heavy) with the task
  queues and supervisord workers
- Add /task/publish_<id>/ route to fix broken publish links in templates

app_urls/scheduled_tasks.json

@@ -393,7 +393,7 @@
   },
   {
     "model": "django_celery_beat.periodictask",
-    "pk": 4,
+    "pk": 15,
     "fields": {
       "name": "Notify status",
       "task": "fetcher.tasks.notify_status",