Co-authored-by: gaborbernat <690238+gaborbernat@users.noreply.github.com>

FishActivator inherited shlex.quote, whose POSIX rules leave a backslash
literal inside single quotes. fish reads \' there as an escaped quote, so a
path or --prompt with a backslash before a quote ended the literal early and
ran the rest as commands, without any error from fish.

Give FishActivator its own quote() that escapes backslashes and quotes.

instantiate_template replaced one placeholder at a time across the whole
template, so a placeholder name inside an already quoted value, such as a
parent directory named __VIRTUAL_NAME__, was rewritten from inside the
finished literal. The second value's quotes closed the first, and the rest
of the path ran as code in bash, fish, xonsh and activate_this.py; in csh
the prompt display tokens broke activate.csh the same way.

Build every token's final text first and substitute them in one regex pass,
with the csh display tokens joining that pass through substitutions().

`pyvenv.cfg` can end up with a path where a plain value should be,
depending on what happens to sit in the directory virtualenv is run
from.

`PyEnvCfg.write()` makes a value absolute when it names something that
exists. The check runs for every key and is relative to the working
directory, so a value that isn't a path gets replaced whenever the
current folder has an entry with the same name. On current `main`:

- `virtualenv 3.14` with Python 3.14 writes `python-version =
/cwd/3.14`, because the environment folder itself matches the value
- with a file or folder called `true` in the working directory,
`--system-site-packages` writes `include-system-site-packages =
/cwd/true`. `site.py` only accepts `true`, so the environment comes up
without the system site-packages and nothing says why
- a `cpython` folder in the working directory does the same to
`implementation` on Windows and macOS, where the lookup ignores case

I reproduced all three on Windows and the first two on Linux.

The check dates back to #2686 (it resolved symlinks then, #3022 changed
it to `abspath`). It only makes sense for keys that hold a path, so this
limits it to those: `home`, `executable`, `base-prefix`,
`base-exec-prefix`, `base-executable` and GraalPy's
`venvlauncher_command`. Every other value is written as given. One thing
to be aware of: a creator plugin that adds a path key of its own no
longer gets it made absolute.

`test_pyenv_cfg_preserves_symlinks` used a made-up key (`test_path`), so
it now uses `home`. There are two new tests. One checks that plain
values survive when the working directory has an entry of the same name,
the other that a relative `home` is still made absolute. Putting the old
line back fails the first on all four keys. Never calling `abspath`, or
dropping `home` from the list, fails the second. Using `realpath` in
place of `abspath` fails the symlink test (run on Linux, my Windows
machine can't create symlinks).

On the outside input: it is the names of files and folders in the
working directory, plus the destination name. Before, those could change
what a non-path key says, and after this they can't. No new input is
read, values still go through the line boundary collapsing from #3247,
and nothing on this path is executed.

- [x] ran the linter to address style issues (`tox -e fix`)
- [x] wrote descriptive pull request text
- [x] ensured there are test(s) validating the fix
- [x] added news fragment in `docs/changelog` folder
- [ ] updated/extended the documentation
- [x] for changes to activation scripts, `pyvenv.cfg`, wheel downloads,
app-data or release workflows: explained in the
PR text which outside input the change handles, such as a path, a prompt
or a downloaded file, and how it stops that
  input from running as code. See the
[security
scope](https://github.com/pypa/virtualenv/blob/main/.github/SECURITY.md#scope).

---------

Co-authored-by: Bernat Gabor <gaborjbernat@gmail.com>