Active response was not passing the filename in file events, ie,
syscheck.  The Eventinfo struct only included file data for builds with
Prelude integration.  This prevented the AR from handing filename off
anyways.
* Eventinfo now contains file data always
* Added *expect* option for 'filename'
* Added FILENAME to ar.h
* Filename validation is tricky, so shell escape instead
  * Added os_shell_escape() to string_op.h, allocates memory for an
    escaped string and passes the pointer back to caller. Caller must
    cleanup that memory.
  * Call os_shell_escape() before passing to execd.
* Added string_test.c to test the os_shell_escape() function.
Fixes to exec.c by Micha Nasriachi
Merge pull request #44 from reyjrar/feature/activeresponse-filename

Feature: activeresponse with filename