escape the WMI hostname and namespace before exec

[somethingwithproof]

Linux_WMI::clean() escaped the username, password, binary and command with cacti_escapeshellarg, but left the device hostname only trim()'d and the query namespace untouched. getcommand() then interpolated both raw into the wmic command line that exec() runs on the Cacti server.
A device configured with a hostname such as

127.0.0.1; touch /tmp/pwned #

therefore executes a command on the poller when its WMI data query runs — a device-manager to server-RCE.

Fix

• escape the hostname and namespace with cacti_escapeshellarg in clean(), like the other fields
• on Windows additionally strip the cmd.exe metacharacters (" & | ^ < > ( ) %) that cmd.exe interprets despite quoting (it ignores \", toggles quoting on every ", and expands %VAR%); a hostname/namespace never legitimately contains these
• drop the now-redundant raw trim() in getcommand()

Test

tests/WmiCommandInjectionTest.php (standalone — the plugin has no harness) confirms an injected hostname is quote-contained on unix and metachar-stripped on Windows. php tests/WmiCommandInjectionTest.php exits 0.

---

Tracking issue for #13, which carries the fix.