child_process: disallow args in execFile/spawn when shell option is true

[DanielVenable]

This will make it throw an error when args are passed to execFile or
spawn when the shell option is true. The reason for this is that when it
accepts args, it gives the false impression that the args are escaped while
really they are just concatenated. This makes it easy to introduce bugs
and security vulnerabilities.

This will break any code that relies on passing args to execFile or
spawn with { shell: true }.

Fixes: #57143

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.22%. Comparing base (922ce9d) to head (180b40a).
Report is 25 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #57199      +/-   ##
==========================================
- Coverage   90.23%   90.22%   -0.02%     
==========================================
  Files         629      629              
  Lines      184939   184948       +9     
  Branches    36232    36233       +1     
==========================================
- Hits       166885   166870      -15     
- Misses      11011    11023      +12     
- Partials     7043     7055      +12     

Files with missing lines	Coverage Δ
lib/child_process.js	97.74% <100.00%> (+0.01%)	⬆️

... and 44 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[RafaelGSS]

This is a semver-major change as it will break people current using the args approach (even being ignored).

I'm not sure if we want to change the API in those situations. I think adding a process.emitWarning could be safer approach in this situation (also semver-major)

[aduh95]

Let's add an entry in deprecation.md since we're effectively deprecating it

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/65461/

[mohd-akram]

Thank you @DanielVenable for creating this PR. What's the update on this? It would be good to get this into Node.js 24 as the freeze is in a couple of weeks.

[aduh95]

@DanielVenable I've rebased to fix the git conflicts. I've also pushed 7a04435 to fix the implementation, PTAL.

[aduh95]

/cc @nodejs/tsc since this is semver-major

[DanielVenable]

@aduh95 LGTM