Properly quote regex replacement string in path canonicalization

Backslashes and dollars in regex replacement strings are interpreted as back references. The canonicalization chokes on paths like:

    /base/path/something/Foo$.js

(because of the `$`). Quoting the replacement string mitigates this.