Fix shell injection bug in `std.urlGet`

[fstirlitz]

This corrects the basically non-functional escaping scheme. An -- argument is added to prevent misinterpreting an initial - as an option character. Curly and square brackets (and backslashes) are additionally escaped to avoid triggering curl’s request batching syntax.

(Sorry for not using the mailing list, I am not currently able to.)