Escape file names when using them in a command

If a file name contains a special character like `%` and we construct a
command for use with `:execute`, that special character will get
expanded.  We need to escape all file names first.