fix(grub-theme): replace unsafe shell decode with Go string processing

decodeShellValue used exec.Command("/bin/sh", "-c", "echo -n "+in)
to strip shell quoting from grub config values (e.g. GRUB_GFXMODE),
creating a command injection surface.

Replace with Go-native string processing that strips matching
surrounding quotes (single or double) directly, eliminating the
shell invocation entirely.

Log: 将 decodeShellValue 中的 shell 命令调用替换为 Go 原生字符串处理，消除命令注入风险
pms: BUG-364821

Author: robertkill

adjust-grub-theme/util.go

@@ -141,13 +141,16 @@ func eval(vars map[string]float64, expr string) (float64, error) {
 }
 
 func decodeShellValue(in string) string {
-	// #nosec G204
-	output, err := exec.Command("/bin/sh", "-c", "echo -n "+in).Output()
-	if err != nil {
-		// fallback
-		return strings.Trim(in, "\"")
+	in = strings.TrimSpace(in)
+	if len(in) >= 2 {
+		if in[0] == '"' && in[len(in)-1] == '"' {
+			return in[1 : len(in)-1]
+		}
+		if in[0] == '\'' && in[len(in)-1] == '\'' {
+			return in[1 : len(in)-1]
+		}
 	}
-	return string(output)
+	return in
 }
 
 const defaultGrubGfxMode = "auto"