Prevent shell injection in load_djpeg

Although `JpegImageFile.load_djpeg` isn't documented or used anywhere, it is public. This fix prevents shell injection in filenames that contain single quotes.