Do we need to guard who can create protocol-level statements? And if so, how would we do that?
I think the only thing we'd need to guard against is a libpq user messing with libpq its own internal protocol-level namespace, let's call that "pqnamespace" for now. We'd add a new version of PQsendPrepare that would take a namespace, but we'd make that return an error if a user of libpq passed pqnamespace as the namespace argument. Similarly for the new PQsendClosePrepared variant that takes a namespace. That way we'd reserve that namespace.
