realpath hygiene for external commands

For external commands which do not support the doubledash convention
(#2613), wrap file arguments in Pathname.new(file).realpath at the
very last minute.  This provides a guarantee against surprises caused
by unusual filenames which might be misinterpreted as flags.
Merge pull request #2623 from rolandwalker/realpath_failsafes

realpath hygiene for external commands