Refactor _exec_cmd to use shlex and lists

[harshnair75567-cloud]

Checklist :

• [ x] If you are new to Scapy: I have checked CONTRIBUTING.md (esp. section submitting-pull-requests)
• [x ] I squashed commits belonging together
• I added unit tests or explained why they are not relevant
• I executed the regression tests (using tox)
• If the PR is still not finished, please create a Draft Pull Request
• [ x] This PR uses (partially) AI-generated code. If so:
  • [x ] I ensured the generated code follows the internal concepts of scapy
  • This PR has a test coverage > 90%
  • [ x] I reviewed every generated line
  • If this PR contains more than 500 lines of code (excluding unit tests) I considered splitting this PR.
  • I considered interoperability tests with existing packages or utilities to ensure conformity of a newly generated protocol

I understand that failing to mention the use of AI may result in a ban. (We do not forbid it, but you must play fair. Be warned !)

fixes #xxx

[harshnair75567-cloud]

_exec_cmd switches from shell=True with a raw string to shell=False with shlex.split, so the command is never interpreted. _npcap_set and _npcap_get pass arguments as a list instead of joining them into a string, removing the injection point before it even reaches _exec_cmd