feat: detect command injection through wrapper APIs (closes #1178)

[bamiebot-maker]

Summary

Implements command injection analysis through wrapper APIs across engine and scanner worker boundaries:

• Engine Analyzer (libs/engine/analyzers/command-injection/):
  • cmd-001: Detects unescaped command execution via wrapper/exec sinks (child_process.exec, execSync, os.system, subprocess.Popen(..., shell=True)) using untrusted user input without safe escaping.
  • cmd-002: Detects dangerous shell option (shell: true, shell=True) enabled on dynamic commands.
  • cmd-003: Detects naive/incomplete sanitization (e.g. .replace(/;/g, '')) that allows command injection bypass.
  • cmd-004: Detects dynamic command string construction via string concatenation or template interpolation.
• Worker Boundary (apps/api/src/scanner/command-injection-scan.job.ts):
  • Tenant isolation (organizationId, repositoryId, analysisJobId), safe analyzer runner with timeouts, and idempotent persistence via FindingsService.
• Fixtures & Tests:
  • Unit tests in libs/engine/analyzers/command-injection/command-injection-analyzer.spec.ts & lexer.spec.ts.
  • Worker boundary tests in apps/api/src/scanner/command-injection-scan.job.spec.ts.
  • Representative fixture repository tests in tests/fixtures/command-injection/command-injection.repositories.spec.ts.
• Documentation:
  • Detailed rules and remediation guide in docs/COMMAND_INJECTION_ANALYSIS.md.

Closes #1178
Closes #1179
Closes #1177

[drips-wave]

@bamiebot-maker Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits