[QA Bot] Harden logging analyzer

# Summary

The `runPowerShellCommand` function in `LoggingAnalyzer.ts` concatenates the `pipelineLink` URL directly into a shell command string using double quotes. While the URL is validated via `new URL(link)` in `shared.ts`, this validation does not escape shell metacharacters such as `$(...)`, which are interpreted by both PowerShell and Bash even within double-quoted strings.

## Current Behavior

```bash
azp analyze "${pipelineLink}"
```

A URL containing shell substitution syntax (e.g., `https://dev.azure.com/azure-sdk/$(whoami)`) passes URL validation but results in the embedded command being executed by the shell.

## Suggested Improvement

Escape or sanitize the `pipelineLink` value before interpolation, or pass it as an argument array to avoid shell interpretation entirely. For example:

- Use `execFile` instead of `exec`/`execAsync` with shell interpolation
- Escape shell metacharacters (`$`, `` ` ``, `\`, `"`, etc.) before concatenation
- Validate that the URL hostname matches an expected allowlist (e.g., `dev.azure.com`)

## Impact

Defense-in-depth hardening to prevent unexpected behavior if a malformed or adversarial URL reaches this code path.

Start in LoggingAnalyzer.ts at runPowerShellCommand and trace the pipelineLink validation in shared.ts. Review how the azp analyze command is assembled, then verify with a URL containing $(whoami) that the value is passed without shell interpretation. Done means adversarial URL input cannot execute embedded PowerShell or Bash syntax.

Written by the indexing model from the issue text.