signer: deal with spaces and quotes in codesign args