wagon-ssh-external doesn't protect file names from shell variable expansion

When constructing SCP command line in ScpExternalWagon#executeScpCommand(...) file names are not processed in any way. Since the command is executed via a shell, the raw, correct file names are subject to shell variable expansion.

This is problematic at least when wagon-ssh-external is used as deployment target in Hudson, whch apparently uses path names like groupId$artifactId in the path that to files that are to be deployed.

Surrounding the file names with single quotes should enough to prevent expansion. Arguably this is something that should be done by the Plexus utility when argument contents are set with Arg.setFile(...), but it doesn't do that and Wagon doesn't use .setFile(...) anyway (and probably couldn't for the remote file).