Don't use escapeshellcmd (fix bad results from pa11y)

We are already escaping the arguments using escapeshellarg.  The rest of the command is hand crafted and not exposed to user input.

Using escapeshellcmd was escaping `?` in URIs, resulting in bad results from pa11y.