fix: command injection vulnerability

due to missing quoting, command injection was possible via
pipeline configuration.

This is now fixed using a quoting and escaping utility.

vars/testsPublishResults.groovy

@@ -1,4 +1,6 @@
 import static com.sap.piper.Prerequisites.checkScript
+// test
+import static com.sap.piper.BashUtils.quoteAndEscape as q
 
 import com.sap.piper.GenerateDocumentation
 import com.sap.piper.ConfigurationHelper
@@ -193,7 +195,7 @@ void touchFiles(pattern){
     echo "[${STEP_NAME}] update test results"
     def patternArray = pattern.split(',')
     for(def i = 0; i < patternArray.length; i++){
-        sh "find . -wholename '${patternArray[i].trim()}' -exec touch {} \\;"
+        sh "find . -wholename ${q(patternArray[i].trim())} -exec touch {} \\;"
     }
 }