fix: prevent command injection via docker options eval

Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.

plugins/builder-pack/builder-build

@@ -41,8 +41,11 @@ trigger-builder-pack-builder-build() {
   DOCKER_ARGS+=" $(: | plugn trigger docker-args-process-build "$APP" "$BUILDER_TYPE")"
   [[ "$DOKKU_TRACE" ]] && DOCKER_ARGS+=" --env=TRACE=true "
 
-  DOCKER_ARGS=" $DOCKER_ARGS "
-  eval set -- "$DOCKER_ARGS"
+  declare -a DOCKER_ARGS_ARRAY=()
+  while IFS= read -r -d '' arg; do
+    DOCKER_ARGS_ARRAY+=("$arg")
+  done < <(fn-docker-args-split "$DOCKER_ARGS")
+  set -- "${DOCKER_ARGS_ARRAY[@]}"
 
   declare -a PACK_ARGS
   while true; do