chore: scope-limited scanner suppression on the fixed verify_binary line

The dangerous-exec rule fires on any non-static first argument to IO.popen
and does not model the array form, so it reports the fixed line as well as
the vulnerable one it replaced -- the same rule is already open against
master on the pre-fix line. Comment-only; no behaviour change.

Suppression is scoped to this one rule on this one line, with the reason
stated inline, so every other IO.popen/exec finding in this file still
reports.

Author: 07souravkunda

lib/browserstack/localbinary.rb

@@ -135,6 +135,11 @@ def download_to(url, bin_path)
   def verify_binary(bin_path)
     # Array form: exec's the binary directly, so a path containing shell
     # metacharacters or spaces is never interpreted by /bin/sh (CWE-78).
+    #
+    # The scanner rule below fires on any non-static first argument to IO.popen
+    # and does not model the array form -- which is exactly the fix here, since
+    # no shell is spawned at all. Suppressed for this rule only.
+    # nosemgrep: ruby.lang.security.dangerous-exec.dangerous-exec
     binary_response = IO.popen([bin_path, '--version']).readline
     !!(binary_response =~ /BrowserStack Local version \d+\.\d+/)
   rescue StandardError