Improve subprocess handling in EKS Helm custom resource handler.

Reason for this change

The EKS Helm custom resource handler used shell=True with subprocess calls, which is not aligned with security best practices. Following Python's recommended approach for subprocess execution improves code robustness and follows secure coding guidelines.

Description of changes

Refactor subprocess execution to follow Python best practices
https://docs.python.org/3/library/subprocess.html#replacing-shell-pipeline

• Replaced shell command strings with array-based commands: Refactored get_oci_cmd() to return structured command objects instead of shell strings
• Implemented proper subprocess pipelines: Used Popen with PIPE to chain aws ecr get-login-password and helm registry login commands following Python documentation recommendations
• Removed shell=True: Adopted array-based command execution as recommended by Python subprocess documentation
• Maintained functionality: Preserved all existing behavior for private ECR, public ECR, and fallback scenarios

Files modified:

• packages/@aws-cdk/custom-resource-handlers/lib/aws-eks/kubectl-handler/helm/__init__.py
• packages/@aws-cdk/aws-eks-v2-alpha/lib/kubectl-handler/helm/__init__.py
• packages/@aws-cdk/aws-eks-v2-alpha/test/integ.alb-controller.js.snapshot/asset.*/helm/__init__.py

Technical approach:

• Commands are now built as arrays: ['helm', 'pull', repository, '--version', version, '--untar']
• Pipeline implementation follows Python subprocess best practices using Popen with proper PIPE connections
• User inputs are passed as separate array elements, ensuring proper argument handling

Describe any new or updated permissions being added

No new IAM permissions required. The change maintains the same AWS API calls and functionality.

Description of how you validated changes

• Functionality testing: Confirmed that ECR authentication and Helm chart pulling continues to work correctly for all scenarios
• Code review: Verified implementation follows Python subprocess best practices as documented in the Python documentation
• Compatibility testing: Ensured backward compatibility with existing CDK Helm chart deployments

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license