Windows command injection: unescaped password in .bat askpass script

Found via code audit. internal/ssh/ssh.go:116-118 Password injected raw into .bat on Windows. Unix path escapes but Windows has none. Password with & or | executes commands.