Fix RCE Vulnerability

[nolanpro]

ci:deploy

[cursor]

PR Summary

Low Risk
Security fix that narrows cancel behavior to expected temp PID files; low residual risk if callers pass valid paths from the build flow.

Overview
Hardens the script-executor cancel API against command injection and arbitrary file read by no longer trusting raw pidFile input.

The endpoint now requires the same admin/custom-executor auth as other script-executor APIs, validates pidFile, and reads the PID only from paths matching /tmp/build_script_executor_* under /tmp with a numeric PID. kill is invoked via sprintf('kill -9 %d', $pid) instead of interpolating unvalidated shell content.

^{Reviewed by Cursor Bugbot for commit 126e5fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[gusys]

Looks good to me

[vladyrichter]

QA server K8S was successfully deployed https://tenant-1.ci-f7a31ba3c6.engk8s.processmaker.net