pw_checkname() already refuses $ ( ) and freinds, but backtick and
single quote slipped thru, so pw useradd 'fooid`'` went in just
fine. Thats command substitution in any unquoted context. Add both
to badchars, plus a test.
Reported by: Harry Sintonen (Reversec)
Sponsored by: Entersekt
MFC after: 2 weeks