fix(package-manager): prevent CWE-78 OS command injection across all Windows spawn paths

[g0w6y]

Problem

Five locations in Angular CLI concatenated user-controlled arguments
into a raw shell string executed by cmd.exe with shell: true.
Any shell metacharacter (&, |, >, ^) in a crafted package
specifier or --package-manager flag value silently injects and
executes arbitrary OS commands alongside the legitimate process.

File	Injection vector
package-managers/host.ts	ng add <pkg>, ng update
tasks/package-manager/executor.ts	Any schematic NodePackageInstallTask
ssr-dev-server/utils.ts	SSR dev-server process spawn
ssr-dev-server/index.ts	spawnAsObservable with stray shell:true
schematics/angular/workspace/index.ts	ng new --package-manager=<value>

Fix

Windows spawn paths (host.ts, executor.ts, utils.ts):
Replace spawn(\${cmd} ${args.join(' ')}`, { shell: true })with directcmd.exearray invocation usingshell: false`. Node.js
controls argument quoting — metacharacters never reach cmd.exe as
shell operators.

// BEFORE — unsafe
spawn(`${command} ${args.join(' ')}`, { shell: isWin32 })

// AFTER — safe
spawn('cmd.exe', ['/d', '/s', '/c', command, ...args], { shell: false })

ssr-dev-server/index.ts: Remove stray shell: true from the
spawnAsObservable call-site. Platform dispatch is handled inside
utils.ts.

workspace/index.ts: Add ALLOWED_PKG_MANAGERS Set guard before
execSync(\${packageManager} --version`). Only npm, yarn, pnpm, bun, cnpmaccepted — blocks all-platform injection viang new --package-manager`.

Relation to prior work

Follows the fix pattern from angular#32678 which patched the analogous
repo-init/executor.ts path. This PR closes all five remaining
vulnerable locations.

Verification

grep -rn "args\.join(' ')\|shell: true\|shell: isWin32" \
  packages/angular/cli/src/package-managers/host.ts \
  packages/angular_devkit/schematics/tasks/package-manager/executor.ts \
  packages/angular_devkit/build_angular/src/builders/ssr-dev-server/utils.ts \
  packages/angular_devkit/build_angular/src/builders/ssr-dev-server/index.ts \
  packages/schematics/angular/workspace/index.ts | grep -v "^\s*//"
# Expected: zero output

CWE: CWE-78 — Improper Neutralisation of Special Elements in an OS Command