Harden phpcs utilities: escape filenames instead of only spaces

The phpcs-pr/phpcs-push helpers built the PHPCS command by concatenating
changed filenames with only spaces backslash-escaped, so other shell
metacharacters in a crafted filename could be interpreted by the shell.
Pass each path through escapeshellarg() instead (and drop the now-redundant
space-escaping loop). The empty-diff early exit is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: LukeTowers

.github/workflows/utilities/phpcs-pr

@@ -16,19 +16,16 @@ if (empty($argv[1])) {
 $fileList = shell_exec('git diff --name-only --diff-filter=ACMR origin/' . $argv[1] . ' HEAD');
 $files = array_filter(explode("\n", $fileList));
 
-foreach ($files as &$file) {
-    if (strpos($file, ' ') !== false) {
-        $file = str_replace(' ', '\\ ', $file);
-    }
-}
-
 // no changes found in diff, early exit
 if (!count($files)) {
     fwrite(STDOUT, "\e[0;32mFound no changed files.\e[0m");
     fwrite(STDOUT, "\n");
     exit(0);
 }
 
+// Escape each path so filenames are passed to the shell safely.
+$files = array_map('escapeshellarg', $files);
+
 // Run all changed files through the PHPCS code sniffer and generate a CSV report
 $csv = shell_exec('phpcs --colors -nq --report="csv" --extensions="php" ' . implode(' ', $files));
 $lines = array_map(function ($row) {

.github/workflows/utilities/phpcs-push

@@ -16,19 +16,16 @@ if (empty($argv[1])) {
 $fileList = shell_exec('git show --name-only --pretty="" --diff-filter=ACMR ' . $argv[1]);
 $files = array_filter(explode("\n", $fileList));
 
-foreach ($files as &$file) {
-    if (strpos($file, ' ') !== false) {
-        $file = str_replace(' ', '\\ ', $file);
-    }
-}
-
 // no changes found in diff, early exit
 if (!count($files)) {
     fwrite(STDOUT, "\e[0;32mFound no changed files.\e[0m");
     fwrite(STDOUT, "\n");
     exit(0);
 }
 
+// Escape each path so filenames are passed to the shell safely.
+$files = array_map('escapeshellarg', $files);
+
 // Run all changed files through the PHPCS code sniffer and generate a CSV report
 $csv = shell_exec('phpcs --colors -nq --report="csv" --extensions="php" ' . implode(' ', $files));
 $lines = array_map(function ($row) {