Escape env value before passing it to system call

You can possible inject shell commands into composer config command.

```
EDITOR="ls;gedit" composer config -e
```