compare: untrusted reference.repo URL echoed unquoted into wget hint

`CompareMojo.diffoscope()` (lines 306-326) reflects user-controlled and artifact-derived data into a `wget` hint printed to the build log:

```java
String url = baseUrl
+ (baseUrl.endsWith("/") ? "" : "/")
+ session.getRepositorySession()
.getLocalRepositoryManager()
.getPathForRemoteArtifact(a, repo, null);
return "wget " + url + "; ls -l " + relative(actual);
```

`baseUrl` comes from the user-provided `reference.repo` parameter; the path is derived from the current artifacts. While the plugin only prints this string (it does not shell-execute it), the echoed value is attacker-influenced during a build of untrusted projects and can be used to spoof/mislead the suggestions a user copy-pastes. Worth sanitizing or explicitly quoting the URL in the hint to avoid confusing/ambiguous instructions.

Start at CompareMojo.diffoscope() in the lines 306-326, where the reference.repo value and artifact-derived path are assembled into the wget hint. Decide on quoting or sanitization that prevents ambiguous copy-paste instructions while preserving the intended hint, then verify that the generated output is unambiguous.

Written by the indexing model from the issue text.