fix: pass converter commands as argv lists instead of via a shell

[dustenhubbard]

Passes the two converter commands as argv lists instead of joining them into a string and running them through a shell, which closes an arbitrary-command-execution path from a shared series file.

Root cause

The scaled-zarr converter and the neuroglancer export built their commands by f-string-quoting fields taken from the series (series.src_dir, series.jser_fp, and the --output argument) and ran them with subprocess.Popen(..., shell=True) on non-Windows platforms:

f"\"{self.series.src_dir}\"",
...
convert_cmd = " ".join(convert_cmd)
subprocess.Popen(convert_cmd, shell=True, stdout=None, stderr=None)

src_dir is read verbatim from series_data["src_dir"] in the .jser. Double quotes do not neutralize a shell: $(...), backticks, and a closing quote followed by ; or && all execute. Opening a series prepared by someone else and then running a conversion, the ordinary next step, runs whatever the field contains, with the user's privileges and no visible sign.

Change

Pass convert_cmd as a list to subprocess.Popen on every platform, with each path a single literal element, and drop shell=True and the manual quoting. The Windows branch already passed a list, so both platforms now share the same argv. Legitimate paths, including paths with spaces, are handled correctly by construction, which is what the quoting was reaching for.

Covers both launch sites: convert_zarr and create_ng_zarr.

Notes

Detail and a reproduction are in the linked issue.

Closes #113