Fix HOTP counter increases

[jorti]

When substituting the counter in a HOTP uri, the replacement string needs to be quoted because it contains a &. Quoting it will avoid & to be replaced with the matching portion of the pattern.

See: https://www.gnu.org/software/bash/manual/html_node/Shell-Parameter-Expansion.html

Fixes #171

[fstecker]

@tadfisher is there any chance you could merge this soon? As long as this isn't fixed, pass-otp does not work with bash 5.2 (at least not for HOTP).