ubox: fix handling of uci lists, prevent shell code injection from uci values (#14548)