Escape plaintext before passing it to xccdf_policy_substitute