fix: sanitize plugin command placeholders

[saurabhhhcodes]

Summary

• call the existing sanitize_input() helper for every user-controlled plugin placeholder before command construction
• strip leading - prefixes from sanitized values so placeholder inputs cannot become tool flags like --debug
• add regression coverage for shell metacharacter stripping and leading-option-prefix removal during interpolation

Fixes #615

Testing

• /Users/saurabhkumarbajpaiai/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 -m py_compile backend/secuscan/plugins.py backend/secuscan/validation.py testing/backend/unit/test_plugins.py
• direct targeted interpolation assertions with Python 3.12:
  • sanitize_input('--debug;$(whoami)') == 'debugwhoami'
  • _interpolate('{templates}', {'templates': '--debug;$(whoami)'}) == 'debugwhoami'
  • _interpolate('--user-agent={user_agent}', {'user_agent': '--verbose|curl'}) == '--user-agent=verbosecurl'
• git diff --check

Note

I attempted the focused pytest command for testing/backend/unit/test_plugins.py testing/backend/unit/test_validation.py, but local dependency installation is blocked by the native pycairo/cairo requirement pulled through xhtml2pdf. The code-level targeted checks above pass under Python 3.12.

[utksh1]

The placeholder hardening is security-relevant, but the PR is not merge-ready with backend-lint/frontend-checks failing. Please rebase on the current CI baseline and get checks green. Also add/keep coverage for legitimate placeholder values so the sanitizer does not break valid non-shell argv use cases.