escape the filename to be extracted

filenames based on URLs can contain all kinds of oddness:
```
Processing remote_file[content?r=snapshots&g=com.foo.bar&a=bar&v=1.0.0-0022-bb48508b-SNAPSHOT&e=tar.gz]
```
so it's worth escaping them before handing them over to tar.