Annotate the two remaining exec sinks for Semgrep

Semgrep's diff scan re-reports php.lang.security.exec-use on both lines,
because the lines changed — the constructs themselves are pre-existing and are
already among master's open findings. Both are now the mitigated versions, so
they are annotated with the reason rather than left to fail the check:

  - isRunning(): the interpolated value is the intval() directly above, guarded
    > 0, so only digits can reach the shell.
  - start(): $call comes from start_command(), where every caller-supplied part
    is escapeshellarg()'d and every unquoted token is a fixed flag name. This is
    precisely the sink this change exists to make safe, and the regression tests
    pin it with payloads that fail on the pre-fix code.

Author: 07souravkunda

lib/Local.php

@@ -100,6 +100,9 @@ public function isRunning() {
       $pid = intval($this->pid);
       if ($pid <= 0)
         return False;
+      // $pid is the intval() above, guarded > 0, so the only bytes that can
+      // reach the shell here are digits.
+      // nosemgrep: php.lang.security.exec-use.exec-use
       $return_message = shell_exec("ps -" . $pid . " | wc -l");
       if (intval($return_message) > 1)
       {
@@ -172,6 +175,11 @@ public function start($arguments) {
     // file literally named '$this->logfile' instead of the configured one.
     system("echo \"\" > " . self::esc($this->logfile));
     $call = $call . " 2>&1";
+    // $call comes from start_command(), where every caller-supplied part is
+    // escapeshellarg()'d and every unquoted token is a fixed flag name. This is
+    // the sink the whole change exists to make safe; tests/LocalTest.php pins
+    // that with payloads that fail on the pre-fix code.
+    // nosemgrep: php.lang.security.exec-use.exec-use
     $return_message = shell_exec($call);
     $data = json_decode($return_message,true);
     if ($data["state"] != "connected") {