Refactor subprocess calls in analysis plugins for better robustness and security

[RinZ27]

Description

Subprocess calls using shell=True and string formatting were identified in several analysis plugins, which can lead to fragility or security risks when handling firmware files with special characters in their names. While these components primarily run internally, I noticed that filenames containing spaces or shell-sensitive characters could potentially lead to command injection or simple execution failures during processing.

Switching these calls to use list-based arguments with shell=False ensures that the OS handles argument parsing directly. I've focused these changes on the qemu_exec and file_system_metadata plugins, as well as the signature compilation script, to improve overall system reliability when processing untrusted input.

Cleaned up logic in start_binary.py specifically addresses a high-risk area where sys.argv inputs were interpolated directly into shell commands. Similar improvements were applied to the mount.py script to ensure that mounting operations are robust against malformed paths.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.43%. Comparing base (c3aff71) to head (dd9ecf5).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1446      +/-   ##
==========================================
- Coverage   92.44%   92.43%   -0.01%     
==========================================
  Files         370      370              
  Lines       20839    20814      -25     
==========================================
- Hits        19264    19240      -24     
+ Misses       1575     1574       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.