fix: use execFileSync for git commands in preInitSetup to prevent shell injection

[svidgen]

Summary

Replace execSync with execFileSync (array form) for the two git commands in packages/amplify-cli/src/init-steps/preInitSetup.ts:

• git ls-remote <url> in validateGithubRepo()
• git clone <url> . in cloneRepo()

Motivation

Using the array-form execFileSync avoids spawning a shell and passes arguments directly to the executable. This is the recommended Node.js child_process API when constructing commands with variable inputs, as it avoids potential issues with special characters in URLs being interpreted by the shell.

Changes

• Import execFileSync from child_process
• Replace execSync(\git ls-remote ${repoUrl}`)withexecFileSync('git', ['ls-remote', repoUrl])`
• Replace execSync(\git clone ${repoUrl} .`)withexecFileSync('git', ['clone', repoUrl, '.'])`

Testing

• Pre-commit hooks (prettier, eslint, commitlint) pass
• No functional change in behavior for valid URLs