packaging: setup: quote database variables

best to quote anything, especially if it contains special characters
such as '&'.

Change-Id: I8c05822580656e9b98d029fa39e8b37caf5b5736
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>