Avoid injection issues in the JDBC datasource (backport #2654)

[jbonofre]

Backport of #2654 to karaf-4.4.x.

There is a minor security issue in the JDBC datasource - the datasource name parameter is concatenated directly into OSGi LDAP-syntax filter strings without escaping.

For example:

feature:install pax-jdbc-derby jdbc
jdbc:ds-create -dn derby -url "jdbc:derby:test;create=true" test
jdbc:ds-create -dn derby -url "jdbc:derby:test2;create=true" test2
jdbc:ds-list
Name  │ Service Id │ Product      │ Version               │ URL              │ Status
──────┼────────────┼──────────────┼───────────────────────┼──────────────────┼───────
test  │ 107        │ Apache Derby │ 10.14.2.0 - (1828579) │ jdbc:derby:test  │ OK
test2 │ 108        │ Apache Derby │ 10.14.2.0 - (1828579) │ jdbc:derby:test2 │ OK

Now jdbc:ds-info * returns information on "test". And jdbc:ds-delete * deletes all tables.

Cherry-picked from 6a86e6f (authored by @coheigea).

Note: PR #2654 is still open against main; this backport is being raised in parallel at the maintainer's request.