Fix unquoted curl options in curlw() to handle paths with spaces

Fix #454: Convert TLS_OPT and NETRC_OPT from strings to arrays so they
are properly quoted when passed to curl. Paths with spaces in
TFENV_NETRC_PATH would previously be word-split.

Uses ${arr[@]+"${arr[@]}"} pattern for safe empty-array expansion on
bash versions older than 4.4 (notably macOS default bash 3.2).

Author: Zordrak

lib/helpers.sh

@@ -65,20 +65,19 @@ fi;
 
 # Curl wrapper to switch TLS option for each OS
 function curlw () {
-  local TLS_OPT="--tlsv1.2";
+  local -a tls_opt=(--tlsv1.2);
 
   # Check if curl is 10.12.6 or above
   if [[ -n "$(command -v sw_vers 2>/dev/null)" && ("$(sw_vers)" =~ 10\.12\.([6-9]|[0-9]{2}) || "$(sw_vers)" =~ 10\.1[3-9]) ]]; then
-    TLS_OPT="";
+    tls_opt=();
   fi;
 
+  local -a netrc_opt=();
   if [[ ! -z "${TFENV_NETRC_PATH:-""}" ]]; then
-    NETRC_OPT="--netrc-file ${TFENV_NETRC_PATH}";
-  else
-    NETRC_OPT="";
+    netrc_opt=(--netrc-file "${TFENV_NETRC_PATH}");
   fi;
 
-  curl ${TLS_OPT} ${NETRC_OPT} "$@";
+  curl ${tls_opt[@]+"${tls_opt[@]}"} ${netrc_opt[@]+"${netrc_opt[@]}"} "$@";
 };
 export -f curlw;