rsync_get_file, rsync_post_file unsafe with shell metacharacters in filename

[zsalvet]

rsync_get_file, rsync_post_file do not escape shell metacharacters in remote filenames and do not use rsync -s,
this is easily exploitable security vulnerability when pulsar is used with older rsync version (<3.2.4).
Using rsync -s should fix it.