Avoid injection issues in the JDBC datasource

[coheigea]

There is a minor security issue in the JDBC datasource - the datasource name parameter is concatenated directly into OSGi LDAP-syntax filter strings without escaping.

For example:

feature:install pax-jdbc-derby jdbc
jdbc:ds-create -dn derby -url "jdbc:derby:test;create=true" test
jdbc:ds-create -dn derby -url "jdbc:derby:test2;create=true" test2
jdbc:ds-list
Name  │ Service Id │ Product      │ Version               │ URL              │ Status
──────┼────────────┼──────────────┼───────────────────────┼──────────────────┼───────
test  │ 107        │ Apache Derby │ 10.14.2.0 - (1828579) │ jdbc:derby:test  │ OK
test2 │ 108        │ Apache Derby │ 10.14.2.0 - (1828579) │ jdbc:derby:test2 │ OK

Now jdbc:ds-info * returns information on "test". And jdbc:ds-delete * deletes all tables.