kconfig: Deny command substitution in string values

The post processed .config file will get included in shell
and makefiles. So make sure that a string does not contain
symbols that allow command substitution.
If such a malformed string is found, return empty string
and report it.

Signed-off-by: Richard Weinberger <richard@nod.at>