fix: set generate-authors shell command built from environment values

[odaysec]

mongosh/scripts/generate-authors.ts

Line 10 in af7658f

import { execSync } from 'child_process';

mongosh/scripts/generate-authors.ts

Lines 17 to 18 in af7658f

	return execSync(
	`git log --reverse --format='%aN <%aE>' --use-mailmap -- ${packagePath}`,

Fix the issue should avoid dynamically constructing the shell command as a single string. Instead, we can use execFileSync, which allows us to pass the command and its arguments separately. This approach ensures that the arguments are not interpreted by the shell, mitigating the risk of command injection.

Specifically:

1. Replace the use of execSync with execFileSync in the getAuthorsGitLog function.
2. Pass the git command and its arguments as separate parameters to execFileSync.
3. Ensure that packagePath is passed as an argument, rather than interpolated into the command string.

[addaleax]

Just going to point out that while there's nothing inherently wrong with this PR, it is effectively a no-op and just adds noise for maintainers, since the way this script is used ensures that it only operates on known and trusted inputs