W-23795356- resolve binaries from PATH to prevent CWD-based RCE

[soridalac]

What does this PR do?

Summary

• Resolve bare binary names to absolute PATH-based paths via shelljs.which() in Generator.execute() before passing to shelljs.exec(), preventing Windows CWD-first
  resolution from executing planted binaries
• Refactor flag.ts to route through Generator.execute() instead of calling shelljs.exec directly
• Harden bare binary usage in command.ts (sf) and plugin.ts (git)
• Skip PATH resolution when the binary is already a relative/absolute path (e.g. bin/dev.cmd)

Verification

• Windows VM (before fix): 3x calc.exe popups
• Windows VM (after fix): Could not find "yarn" on PATH — no execution
• macOS (after fix): Runs normally using real yarn from PATH — no regression

Test Plan

• Unit tests: binary-not-found throws, dry-run skips execution
• VM: PoC sf-yarn-rce-poc no longer triggers calc.exe
• macOS: sf dev generate command works normally against linked plugin

What issues does this PR fix or reference?

@W-23795356@