Clean up ReleaseBundlingSupports calling of ShellCommands.

Escapes several of the paths, and gets rid of hardcoding bash -c in several locations.

--
MOS_MIGRATED_REVID=96927479
diff --git a/src/main/java/com/google/devtools/build/lib/actions/Artifact.java b/src/main/java/com/google/devtools/build/lib/actions/Artifact.java
index 8220bd2..f6e99dc 100644
--- a/src/main/java/com/google/devtools/build/lib/actions/Artifact.java
+++ b/src/main/java/com/google/devtools/build/lib/actions/Artifact.java
@@ -24,6 +24,7 @@
 import com.google.common.collect.Iterables;
 import com.google.devtools.build.lib.actions.Action.MiddlemanType;
 import com.google.devtools.build.lib.concurrent.ThreadSafety.Immutable;
+import com.google.devtools.build.lib.shell.ShellUtils;
 import com.google.devtools.build.lib.syntax.Label;
 import com.google.devtools.build.lib.syntax.SkylarkCallable;
 import com.google.devtools.build.lib.syntax.SkylarkModule;
@@ -376,6 +377,13 @@
     return getExecPath().getPathString();
   }
 
+  /*
+   * Returns getExecPathString escaped for potential use in a shell command.
+   */
+  public final String getShellEscapedExecPathString() {
+    return ShellUtils.shellEscape(getExecPathString());
+  }
+
   @SkylarkCallable(name = "short_path", structField = true,
       doc = "The path of this file relative to its root. This excludes the aforementioned "
       + "<i>root</i>, i.e. configuration-specific fragments of the path. This is also the path "