fix: use shutil.which to resolve sf path, remove shell=True

Addresses reviewer concern about command injection risk with shell=True.
shutil.which resolves the sf executable (falling back to sf.cmd on
Windows), keeping shell=False everywhere while still working on Windows.

Author: ro-mo-do

src/datacustomcode/token_provider.py

@@ -97,11 +97,19 @@ def __init__(self, sf_cli_org: str):
     def get_token(self) -> "AccessTokenResponse":
         """Get token from Salesforce SF CLI"""
         import json
+        import shutil
         import subprocess
-        import sys
 
         from datacustomcode.deploy import AccessTokenResponse
 
+        sf_path = shutil.which("sf") or shutil.which("sf.cmd")
+        if sf_path is None:
+            raise RuntimeError(
+                "The 'sf' command was not found. "
+                "Install Salesforce CLI: "
+                "https://developer.salesforce.com/tools/salesforcecli"
+            )
+
         def _run_sf_command(args: list[str], description: str) -> dict:
             try:
                 result = subprocess.run(
@@ -110,14 +118,7 @@ def _run_sf_command(args: list[str], description: str) -> dict:
                     text=True,
                     check=True,
                     timeout=30,
-                    shell=sys.platform == "win32",
                 )
-            except FileNotFoundError as exc:
-                raise RuntimeError(
-                    "The 'sf' command was not found. "
-                    "Install Salesforce CLI: "
-                    "https://developer.salesforce.com/tools/salesforcecli"
-                ) from exc
             except subprocess.TimeoutExpired as exc:
                 raise RuntimeError(
                     f"'{description}' timed out for org '{self.sf_cli_org}'"
@@ -144,7 +145,7 @@ def _run_sf_command(args: list[str], description: str) -> dict:
 
         # Get org info from sf org display
         display_data = _run_sf_command(
-            ["sf", "org", "display", "--target-org", self.sf_cli_org, "--json"],
+            [sf_path, "org", "display", "--target-org", self.sf_cli_org, "--json"],
             "sf org display",
         )
         result_data = display_data.get("result", {})
@@ -161,7 +162,7 @@ def _run_sf_command(args: list[str], description: str) -> dict:
         try:
             token_data = _run_sf_command(
                 [
-                    "sf",
+                    sf_path,
                     "org",
                     "auth",
                     "show-access-token",