CVE-2026-71538: @cyclonedx/cyclonedx-npm Windows Shell Injection via --workspace

The root cause is in src/npmRunner.ts. The Windows fallback code path builds a shell command string by concatenating the raw --workspace value into it, then passes the whole string to cmd.exe /c. On Windows, & and && are command separators recognized by cmd.exe, so a crafted workspace name like foo & calc.exe causes the shell to execute calc.exe (or any other command) as a second token.

The fix in PR #1489 removes the shell-string construction entirely. npm is now invoked directly as a child process with arguments passed as an array, so metacharacters in the workspace value are never interpreted by a shell. This matches the standard mitigation for CWE-78: avoid shell interpolation and use argument arrays instead.