npm,npx: quote argument expansions

Using $@ instead of "$@" means

    npm "foo bar"

will be expanded to

    npm foo bar

unexpectedly.

Also, pwd output may contain spaces.

Caught by shellcheck.

Change-Id: I045ac3289e65698c6c1fb1396420fba8fe0473e1
Reviewed-on: https://go-review.googlesource.com/c/website/+/635615
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Hyang-Ah Hana Kim <hyangah@gmail.com>
diff --git a/npm b/npm
index 0d1978c..38b9616 100755
--- a/npm
+++ b/npm
@@ -5,9 +5,9 @@
 
 docker run \
   --rm \
-  --volume $(pwd):/workspace \
+  --volume "$(pwd)":/workspace \
   --workdir /workspace \
   --env NODE_OPTIONS="--experimental-vm-modules --no-warnings" \
   --entrypoint npm \
   node:16.13.1-alpine3.14 \
-  $@
+  "$@"
diff --git a/npx b/npx
index 8800b90..d8152c1 100755
--- a/npx
+++ b/npx
@@ -5,9 +5,9 @@
 
 docker run \
   --rm \
-  --volume $(pwd):/workspace \
+  --volume "$(pwd)":/workspace \
   --workdir /workspace \
   --env NODE_OPTIONS="--experimental-vm-modules --no-warnings" \
   --entrypoint npx \
   node:16.13.1-alpine3.14 \
-  $@
+  "$@"