ddns-scripts: fix root command injection through ddns_dateformat

ddns-scripts: fix root command injection through ddns_dateformat

The date format read from the UCI option ddns.global.ddns_dateformat was
embedded into a command string that is later executed through "eval", both
for the recurring log timestamps

  DATE_PROG="date +'$ddns_dateformat'"
  ...
  write_log 5 "PID '$$' started at $(eval $DATE_PROG)"

and for the "last update" timestamp in the updater

  EPOCH_TIME="date -d @$EPOCH_TIME +'$ddns_dateformat'"
  write_log 7 "last update: $(eval $EPOCH_TIME)"

The value is only wrapped in single quotes, so a single quote inside it
closes that quote and starts a new shell word. A user who can write the ddns
configuration - a delegated DDNS operator who was never granted shell access
- can set

  ddns_dateformat="%F'; touch /tmp/pwned; '"

and have arbitrary commands run as root, because the updater runs as root.
The injection triggers on the next start of the updater, so in practice on
the next reconfiguration or reboot.

Stop building shell code from the option. Provide date_prog() as an ordinary
shell function and pass the format as a single quoted argument in both
places, which leaves no way for its content to be interpreted by the shell.
The remaining use of ddns_dateformat in dynamic_dns_updater.sh, for
NEXT_CHECK_TIME, already substituted it as a quoted argument without eval
and was not affected.

luci-app-ddns consumes the same option and is fixed separately in the LuCI
repository.

Reported-by: Matthew Hickey (Hacker Fantastic, https://hacker.house)
Fixes: 1c20dcb71a69 ("ddns-scripts: update to 2.7.6-1")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hauke Mehrtens <redacted>