Fix: Command injection blocks builder

[AmirGhMohseni]

Fix: Command Injection in blocks-builder.ts -- Issue 383

This PR addresses a critical Command Injection vulnerability in the workflow engine.

Changes:

• Removed shell: true from spawn()
• Added allowlist for safe commands (npm, yarn, etc.)
• Added input validation to block shell metacharacters (;, |, &, etc.)
• Added unit tests for security validation

Why this matters:

• The vulnerable code allowed arbitrary OS command execution if attacker-controlled input reached command or args.
• This directly impacts the workflow engine, a critical bounty scope.
• Follows best practice: never use shell: true with untrusted input.

This vulnerability was detected via Semgrep: javascript.lang.security.detect-child-process