Wrap autocomplete widget query in db_like() to escape special symbols

Right now we don't autocomplete correctly on filenames with special characters in the (_ and %). We should escape them with db_like().