diff_test does not escape the error message string and allows for shell injection

Strings in `failure_message` are interpolated into the generated shell script without escaping special characters:
```
diff_test(
name ="foo",
file1 = ":a.txt",
file2 = ":b.txt",
failure_message = "shell injection: `echo hello world`",
)
```

Actual test output:

```
exec ${PAGER:-/usr/bin/less} "$0" || exit 1
Executing tests from //:foo
-----------------------------------------------------------------------------
1d0
< 1
FAIL: files "a.txt" and "b.txt" differ. shell injection: hello world
```

expected:
```
exec ${PAGER:-/usr/bin/less} "$0" || exit 1
Executing tests from //:foo
-----------------------------------------------------------------------------
1d0
< 1
FAIL: files "a.txt" and "b.txt" differ. shell injection: `echo hello world`
```

Same issue with using `failure_message = "$(echo hello world)"`

Locate the diff_test implementation and reproduce the issue with the provided failure_message values using backticks and $(...). Trace how the generated shell script incorporates failure_message, then verify that both forms remain literal in the failure output and do not execute commands.

Written by the indexing model from the issue text.