fix: sanitize plugin command placeholders

[saurabhhhcodes]

Summary

• call the existing sanitize_input() helper for every user-controlled plugin placeholder before command construction
• strip leading - prefixes from sanitized values so placeholder inputs cannot become tool flags like --debug
• add regression coverage for shell metacharacter stripping and leading-option-prefix removal during interpolation

Fixes #615

Testing

• /Users/saurabhkumarbajpaiai/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 -m py_compile backend/secuscan/plugins.py backend/secuscan/validation.py testing/backend/unit/test_plugins.py
• direct targeted interpolation assertions with Python 3.12:
  • sanitize_input('--debug;$(whoami)') == 'debugwhoami'
  • _interpolate('{templates}', {'templates': '--debug;$(whoami)'}) == 'debugwhoami'
  • _interpolate('--user-agent={user_agent}', {'user_agent': '--verbose|curl'}) == '--user-agent=verbosecurl'
• git diff --check

Note

I attempted the focused pytest command for testing/backend/unit/test_plugins.py testing/backend/unit/test_validation.py, but local dependency installation is blocked by the native pycairo/cairo requirement pulled through xhtml2pdf. The code-level targeted checks above pass under Python 3.12.

[utksh1]

The placeholder hardening is security-relevant, but the PR is not merge-ready with backend-lint/frontend-checks failing. Please rebase on the current CI baseline and get checks green. Also add/keep coverage for legitimate placeholder values so the sanitizer does not break valid non-shell argv use cases.

[utksh1]

Reviewed the updated placeholder sanitization diff. It is focused on plugin command interpolation, includes regression coverage for dangerous placeholder values and safe argv values, and current checks are green. Approved pending update with main and fresh CI.