Sanitise classname in picture.vars.php

This seems to be similar to a few other Bootstrap issues, but we hit a case where the value of $variables['attributes']['class'] coming into bootstrap_preprocess_picture is sometimes a string instead of an array. This patch sanitises the class attribute the same way it's done in links.vars.php and other places in Bootstrap.