Security: Command Injection Vulnerability

Hey there!

During security reviews I discovered an issue in audioread/ffdec.py

The code uses `subprocess.Popen` to execute external commands (`ffmpeg` or `avconv`) with a user-provided `filename` as part of the command arguments. This creates a significant command injection vulnerability, as a malicious filename could contain arbitrary shell commands, leading to remote code execution on the system.

https://github.com/beetbox/audioread/blob/577f8e2cbe99f33dd7d236deb1626e372f4762e9/audioread/ffdec.py#L144

Start in audioread/ffdec.py at the Popen call around line 144 and trace how the filename reaches the ffmpeg or avconv command. Verify the invocation remains functional while a filename containing shell metacharacters cannot execute unintended commands; confirm the change with focused reproduction checks and the existing test suite.

Written by the indexing model from the issue text.