fix sharing update, add proper escaping

fix for https://github.com/owncloud/core/issues/9863

cc @PVince81 @DeepDiver1975 @LukasReschke @craigpg @karlitschek 
It must be guaranteed that array_keys($subList) is not user-controllable or you must use array_map('intval', array_keys($subList)) instead to prevent injection below.