Fix PowerShell command injection via unescaped single quotes in file paths

[msarg44]

Summary

All five Set-/Get-ProcessMitigation file-path call sites in ExploitProtection.PY embed a user-chosen or user-influenced path directly inside a single-quoted PowerShell string without any escaping:

• update_online_xml() (validation + import)
• backup_current_settings()
• import_local_xml()

Why it matters

In PowerShell, a literal single quote inside a single-quoted string must be escaped by doubling it (''). Without this:

1. Correctness bug — a perfectly legitimate path containing an apostrophe (very common on Windows, e.g. C:\Users\User's Documents\...) terminates the string early and breaks the command, so install/import/backup silently fails.
2. Security bug — a crafted path such as C:\tmp'; Set-Item ...' lets an attacker who influences the path (e.g. via the XML import dialog, the online-XML download location, or a file name) break out of the quoted argument and inject arbitrary PowerShell. This is a PowerShell command-injection primitive.

Fix

Added a small ps_quote() helper that doubles literal single quotes (the PowerShell escape sequence for single-quoted strings) and wrapped every interpolated path in it, so install, import, and backup paths are safe regardless of their contents.

def ps_quote(value):
    """Escape a path for safe use inside a single-quoted PowerShell string."""
    return value.replace("'", "''")

No behavior change for normal paths — only paths containing an apostrophe are affected.