Instead of calling `run_command` with a formatted
string, call it with a list to maintain safer argument
separation.
Also, introduce a wrapper for `run_command`, `run_pkgng`,
which manages the process environment and some common
command line switches, based upon the module parameters.
Introduced in this commit, also pass annotation values
to `pkg annotate` via stdin, which is safer with long
values than putting them in argv.
ec03bc1a2a