core/unit: add UNIT_ESCAPE_EXEC_SYNTAX

Unfortunately we can't escape $ when ':' is used to prohibit variable expansion:
  ExecStart=:echo $$
is not the same as
  ExecStart=:echo $

This just adds the functionality and the unittests, without using it anywhere
for real yet.

src/core/unit.c

@@ -36,6 +36,7 @@
 #include "load-dropin.h"
 #include "load-fragment.h"
 #include "log.h"
+#include "logarithm.h"
 #include "macro.h"
 #include "missing_audit.h"
 #include "mkdir-label.h"
@@ -4312,7 +4313,7 @@ static const char* unit_drop_in_dir(Unit *u, UnitWriteFlags flags) {
 
 const char* unit_escape_setting(const char *s, UnitWriteFlags flags, char **buf) {
         assert(s);
-        assert(!FLAGS_SET(flags, UNIT_ESCAPE_EXEC_SYNTAX_ENV | UNIT_ESCAPE_C));
+        assert(popcount(flags & (UNIT_ESCAPE_EXEC_SYNTAX_ENV | UNIT_ESCAPE_EXEC_SYNTAX | UNIT_ESCAPE_C)) <= 1);
         assert(buf);
 
         _cleanup_free_ char *t = NULL;
@@ -4334,15 +4335,17 @@ const char* unit_escape_setting(const char *s, UnitWriteFlags flags, char **buf)
         /* We either do C-escaping or shell-escaping, to additionally escape characters that we parse for
          * ExecStart= and friends, i.e. '$' and quotes. */
 
-        if (flags & UNIT_ESCAPE_EXEC_SYNTAX_ENV) {
+        if (flags & (UNIT_ESCAPE_EXEC_SYNTAX_ENV | UNIT_ESCAPE_EXEC_SYNTAX)) {
                 char *t2;
 
-                t2 = strreplace(s, "$", "$$");
-                if (!t2)
-                        return NULL;
-                free_and_replace(t, t2);
+                if (flags & UNIT_ESCAPE_EXEC_SYNTAX_ENV) {
+                        t2 = strreplace(s, "$", "$$");
+                        if (!t2)
+                                return NULL;
+                        free_and_replace(t, t2);
+                }
 
-                t2 = shell_escape(t, "\"");
+                t2 = shell_escape(t ?: s, "\"");
                 if (!t2)
                         return NULL;
                 free_and_replace(t, t2);

src/core/unit.h

@@ -542,8 +542,11 @@ typedef enum UnitWriteFlags {
         /* Escape elements of ExecStart= syntax, incl. prevention of variable expansion */
         UNIT_ESCAPE_EXEC_SYNTAX_ENV = 1 << 4,
 
+        /* Escape elements of ExecStart=: syntax (no variable expansion) */
+        UNIT_ESCAPE_EXEC_SYNTAX     = 1 << 5,
+
         /* Apply C escaping before writing */
-        UNIT_ESCAPE_C               = 1 << 5,
+        UNIT_ESCAPE_C               = 1 << 6,
 } UnitWriteFlags;
 
 /* Returns true if neither persistent, nor runtime storage is requested, i.e. this is a check invocation only */