fix: prevent command injection via docker options eval

Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.

plugins/common/functions

@@ -245,6 +245,12 @@ fn-plugn-trigger-exists() {
   return 1
 }
 
+fn-docker-args-split() {
+  declare desc="tokenizes a docker args string into NUL-delimited fields without shell expansion"
+  declare DOCKER_ARGS="$1"
+  printf "%s" "$DOCKER_ARGS" | xargs -r printf "%s\0"
+}
+
 is_valid_app_name() {
   declare desc="verify that the app name matches naming restrictions"
   local APP="$1"