feat: bypass shell if app is given as a string array

[rix0rrr]

When executing CDK apps, users specify the { "app" } command as:

• a string (heavily advertised); or
• a string[] (not really advertised but historically possible through specific code paths).

Traditionally we would collapse both forms to a single string, by joining the array with spaces, and then shell executing them.

Security people don't like shell execution very much, because there are chances the command gets injected by special characters and redirected to do something else. Developers don't shell shell execution very much because they have to pay attention to quoting of paths with spaces in them.

If we have a string[] already, we shouldn't need to run a command through the shell anymore, but we do. This PR changes the behavior as follows:

• We retain the form of command line that the user gave us (string or argv array)
• When we ultimately run the command, if the user gave us a string we'll run it through the shell but if they gave us an argv array we'll execute it directly.

This protects users against quoting issues and shell injections.

A potential breaking change of this PR could be that if people used to put shell strings in arrays, knowing full well they would execute through the shell regardless, that won't do what they expect anymore. Examples of cursedness that would fail if we merge this:

{ 
  // > used to be interpreted by the shell, now it will be treated as an argument to command.js
  "app": ["command.js", ">", "output.txt"],
}

{ 
  // Users needed to put additional quotes inside the quoted array because we would just string-join everything
  // Now the additional quotes are unnecessary
  "app": ["\"/path with spaces/command.js\"", "arg1"],
}

The risk profile of this "fix/feat" depends on how many instances of the above there are. Chances are good there will be 0 or negligibly many.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license