always submit external commands in list form

For safety.
- This is a step toward reworking system_command.rb so that
invocations are done in list form on the back end, avoiding
surprises from quoting and shell metacharacters.
- There is one transitional hack here: the _quote method in
Cask::SystemCommand is modified to avoid double-quoting.  The
_quote method itself will go away in a future revision when
only list-forms are used.
- Casks using system are not touched. It seems natural to
address that when creating the DSL for after_install/before_install.