Fix command injection

The HtmlDocPath and Options options can now only be set via the global MediaWiki configuration.

Other options are now given to escapeshellarg() before being injected in the built command that will be executed via shell_exec().