Why are subprocess exec rule not included in the semgrep rules

Right now, while publishing the app the Audit fails with subprocess exec

```
frappe-subprocess-exec

subprocess call spawns an external process. Needs to be reviewed by review/security team to confirm arguments are a static list and any interpolated values are validated.
```

It should also be part of this semgrep rule if this needs to be enforced

No file or test is named. Start by locating the semgrep rule for frappe-subprocess-exec and the publishing app Audit configuration; determine how subprocess exec calls are matched, then verify that the intended calls are included and the Audit reports them consistently.

Written by the indexing model from the issue text.