Improve RunFromPackageHandler parameter escaping

**Summary**

A few places in the Linux specialization path build `bash -c ""` strings by directly interpolating filesystem paths and URIs into the command. If any of these values ever contains a shell metacharacter (space, `''`, `"`, `$`, `` ` ``, `;`, `&`, `|`, etc.), the resulting command will either fail to parse or behave incorrectly. We should harden the composition so the commands are robust to arbitrary path/URI content.

**Affected call sites**

All three pass strings into `IBashCommandHandler.RunBashCommand(...)`, which executes them via `bash -c`:

- `src/WebJobs.Script.WebHost/Management/LinuxSpecialization/RunFromPackageHandler.cs`
- `GetPackageType`: `` $"{BashCommandHandler.FileCommand} -b {filePath}" `` — `filePath` is unquoted.
- `UnsquashImage`: `` $"{UnsquashFSExecutable} -f -d ''{scriptPath}'' ''{filePath}''" `` — single-quoted, but a literal `''` in the path would break out of the quoting.
- `src/WebJobs.Script.WebHost/Management/LinuxSpecialization/PackageDownloadHandler.cs`
- `AriaDownload`: `` $"{Aria2CExecutable} --allow-overwrite -x12 -d {directory} -o {fileName} ''{zipUri}''" `` — `directory` and `fileName` are unquoted; `zipUri` is single-quoted but not escaped.

**Proposed change**

Add a small POSIX single-quote escape helper (e.g. on `BashCommandHandler` or a static utility) that wraps a value in `''…''` and escapes any embedded `''` as `''\''''`, and use it for every interpolated value in the three call sites above. Something equivalent to:

```csharp
internal static string SingleQuote(string value)
=> "''" + value.Replace("''", "''\\''''") + "''";
```

Then rewrite the three commands to use it for `filePath`, `scriptPath`, `directory`, `fileName`, and `zipUri.ToString()`.

**Why scope it this way**

- The change is intentionally minimal: no public API changes, no changes to `IBashCommandHandler`, no changes to how the process is launched, no changes to logging/sanitization.
- Existing tests in `RunFromPackageHandlerTests` and `PackageDownloadHandlerTests` mock `RunBashCommand` with `It.IsAny()` or `StartsWith(...)` predicates, so they should continue to pass without modification. Worth confirming during the PR.

**Out of scope (intentionally)**

- Refactoring to argv-based `ProcessStartInfo.ArgumentList` to bypass `bash -c` entirely. That''s a cleaner long-term design but is a larger change with broader test impact; can be considered separately.
- Any change to how `WEBSITE_RUN_FROM_PACKAGE` is validated or consumed elsewhere.

**Regression risk**

Low. The escaping is purely additive: any input that works today (paths/URIs without metacharacters) produces a semantically equivalent quoted command. Inputs that contain a `''` — which can technically appear in Linux paths today and would currently break `UnsquashImage` — would start working correctly, which is a positive change but worth calling out in the PR description.

**Validation**

- Existing unit/integration tests should pass unchanged.
- Optional: add a focused unit test for the escape helper covering values containing spaces, single quotes, and other metacharacters.

Start with src/WebJobs.Script.WebHost/Management/LinuxSpecialization/RunFromPackageHandler.cs and PackageDownloadHandler.cs, then review the RunFromPackageHandlerTests and PackageDownloadHandlerTests predicates around RunBashCommand. Implement the scoped POSIX single-quote escaping change for the five named values, and confirm the existing tests pass while commands remain valid for spaces, quotes, and other metacharacters.

Written by the indexing model from the issue text.