Fix shell injection in the Zimbra backup and restore scripts

Both scripts built a command string by interpolating user input into
bash -c:

    sudo -u zimbra bash -c "... -m '$EMAIL' ..."

The single quotes inside the double-quoted string are not protection --
the outer shell expands $EMAIL first. An address of

    x' ; id ; echo '

closes the quote and runs arbitrary commands. Both scripts require root
and invoke this through sudo -u zimbra, so injected commands execute as
the account that owns the entire mail store. Verified against the exact
quoting pattern before and after the change.

Fixed by single-quoting the script body so nothing is interpolated, and
passing values as positional arguments. The bash -c wrapper is kept
deliberately rather than calling zmmailbox directly, since it may depend
on shell setup and this could not be tested against a live Zimbra.

Two related holes in the same input paths:

- $EMAIL is also part of the backup filename, so a "/" wrote outside
  $BACKUP_DIR. Now validated as a plain address.
- The restore prompt took a filename and concatenated it into a path, so
  "../../etc/shadow" escaped $BACKUP_DIR. Now rejects anything
  containing a separator.

Also switched the backup listing from `ls | grep "$EMAIL"` to a find
with grep -F: unquoted the address was treated as a regex, so "." in it
matched any character.

zimbra_backup.sh

@@ -24,6 +24,14 @@ fi
 read -p "Enter Zimbra username (email address): " EMAIL
 read -p "Enter backup directory (absolute path) [/opt/zimbra/backups]: " BACKUP_DIR
 
+# Reject anything that is not a plain address. $EMAIL is used both as a
+# command argument and as part of the backup filename, so a "/" here
+# would write outside $BACKUP_DIR entirely.
+if ! [[ "$EMAIL" =~ ^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$ ]]; then
+    echo "❌ Not a valid email address: $EMAIL"
+    exit 1
+fi
+
 # Use default if none provided
 BACKUP_DIR=${BACKUP_DIR:-/opt/zimbra/backups}
 
@@ -45,7 +53,11 @@ fi
 
 # Run zmmailbox command as zimbra user
 echo "📦 Starting backup..."
-sudo -u zimbra bash -c "/opt/zimbra/bin/zmmailbox -z -m '$EMAIL' getRestURL '//?fmt=tgz'" > "$BACKUP_FILE"
+# The script body is single-quoted so nothing is interpolated into it;
+# $EMAIL arrives as a positional argument instead. Interpolating it (as
+# this line previously did) let any shell metacharacter in the address
+# run commands as the zimbra user, which owns the whole mail store.
+sudo -u zimbra bash -c '/opt/zimbra/bin/zmmailbox -z -m "$1" getRestURL "//?fmt=tgz"' _ "$EMAIL" > "$BACKUP_FILE"
 
 # Verify success
 if [ $? -eq 0 ]; then