CVE-2026-39884: MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting

The port_forward tool in mcp-server-kubernetes constructs a kubectl command as a string and splits it on spaces before passing to spawn(). Unlike all other tools in the codebase which correctly use execFileSync("kubectl", argsArray), port_forward uses string concatenation with user-controlled input (namespace, resourceType, resourceName, localPort, targetPort) followed by naive .split(" ") parsing. This allows an attacker to inject arbitrary kubectl flags by embedding spaces in any of these fields.