LXC: Use a shell wrapper script instead of inlining args

This refs #16144 and the pb with temporary scripts (CVE)