Sanitize spawn calls which contain .cmd for win32

[Promytheos]

See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2 and
#1429

[raineorshine]

There was a broken test in main that snuck in because the test was incorrectly written against live data from the npm registry that changed. I disabled it in 3f5f58a and rebased the PR branch on main so the CI result should be accurate now.

[raineorshine]

Thanks!

[Promytheos]

Did some more digging, I'm thinking it may make sense to move away from cross spawn at some point. It hasn't been updated in the last 4 years and doesn't look like the owner is actually responding to issues or PR's. The reason this was failing is probably due to the path in __dirname is posix, which windows does not fancy. cross-spawn does some handling for that when it parses the arguments, but only if shell is not set to true (which is exactly what we want it to be). So solution might be to sanitize the paths before we call spawn. Thing is, once we go down this rabbit hole, we're effectively doing what cross-spawn does so it makes having that as a dependency less useful

[Promytheos]

TLDR; reason it failed with my fix was due to cross-spawn not parsing the options (due to {shell: true}).

[raineorshine]

Great, thanks for the additional research and explanation! Too bad it was not an easy fix :/