Use proper parameter substitution.
Summary: This avoids bugs/vulnerability with filenames containing a quote.
Reviewers: ardumont, moranegg, Reviewers
Reviewed By: ardumont, Reviewers
Differential Revision: https://forge.softwareheritage.org/D474