B602: subprocess_popen_with_shell_equals_true bandit.plugins.injection_shell subprocess_popen_with_shell_equals_true