fix(homebrew-update): escape && so the plist is valid XML

The bash -c command used bare && inside a <string>, which isn't valid
XML: plutil -lint rejects the file, and launchd only loaded it because
its parser is lenient. Escape the operator, and move PATH into
EnvironmentVariables so the command stays short enough that an XML
formatter has no reason to re-wrap it.

LaunchAgents/com.user.homebrew-update.plist

@@ -8,8 +8,13 @@
     <array>
         <string>/bin/bash</string>
         <string>-c</string>
-        <string>export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH" && brew update && brew upgrade</string>
+        <string>brew update &amp;&amp; brew upgrade</string>
     </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    </dict>
     <key>StartCalendarInterval</key>
     <dict>
         <key>Hour</key>