fix: prevent command injection via working_dir parameter in sidecar

Apply shlex.quote() to sanitize the working_dir parameter before shell
command interpolation in wrap_cmd(). This prevents command injection
attacks via shell metacharacters (e.g., `/tmp; id #`).

Fixes wipash/K8sInterpreter#1