GHSA-69qj-pvh9-c5wg: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

yt-dlp’s --exec option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. %(title)s) or other unsafe conversions. An attacker could achieve remote code execution on the user’s machine via maliciously crafted metadata containing quotes or other special shell characters.