improve unsafe path handling (#3927)

* fix: improve unsafe path handling

Paths containing spaces or dashes were being interpreted as separate options, since the path handling lacked double quotes.

This fixes all unsafe instances of "PWD" and "HOME", along with all other unsafe paths in the scripts.

* readme: explicitly mount the configuration as read-only

This clearly shows users that the MediaMTX container will not modify the configuration file.

scripts/test.mk

@@ -25,13 +25,13 @@ export DOCKERFILE_TEST
 test:
 	echo "$$DOCKERFILE_TEST" | docker build -q . -f - -t temp --build-arg ARCH=amd64
 	docker run --rm \
-	-v $(PWD):/s \
+	-v "$(PWD):/s" \
 	temp \
 	make test-nodocker
 
 test32:
 	echo "$$DOCKERFILE_TEST" | docker build -q . -f - -t temp --build-arg ARCH=i386
 	docker run --rm \
-	-v $(PWD):/s \
+	-v "$(PWD):/s" \
 	temp \
 	make test-nodocker