ExternalProject: Prevent URL list-splitting on special characters

If a URL contains special characters like parentheses and a few others,
they would previously have caused a foreach() call that iterates over the
URLs to parse those special characters as separate, unquoted arguments.
They would then have effectively split the list of URLs at unexpected places.
Prepare the arguments for the foreach() call by using use bracket syntax
to robustly handle any URLs that do have unescaped special characters.

Issue: #25148