Always single-quote directory when cd'ing to get shell env (#9145)

This avoids us potentially executing code (if someone were to name their
directory `$(echo you-are-pwned > /secure-files)`, for example).

Works with zsh, bash, fish, nushell. Tested locally with all of them.

Release Notes:

- N/A

crates/project/src/project.rs

@@ -9601,7 +9601,8 @@ async fn load_shell_environment(dir: &Path) -> Result<HashMap<String, String>> {
         });
 
     let command = format!(
-        "cd {dir:?};{} echo {marker}; /usr/bin/env -0; exit 0;",
+        "cd '{}';{} echo {marker}; /usr/bin/env -0; exit 0;",
+        dir.display(),
         additional_command.unwrap_or("")
     );