Callback: move string utilities out of Callback.Make
Callback: add absCommand helper, fix Demo2 shell-injection vulnerability