[Aikido] Detect IFS variable expansion patterns in shell injection checks

[aikido-autofix]

This patch addresses shell injection detection bypass vulnerabilities where attackers could use IFS (Internal Field Separator) variable expansion patterns like ${IFS} to evade detection by creating runtime command separators. The fix adds pattern detection for variable expansion constructs that can expand to shell metacharacters, preventing attackers from circumventing shell injection protections. Changes were made to the shell injection detection logic in contains_shell_syntax.py with corresponding test coverage added to contains_shell_syntax_test.py and detect_shell_injection_test.py.

✅ 1 issue fixed by this PR

Issue	Severity	Description
CodeAudit#811708321	HIGH	This is a real enforcement bypass, not merely a parser discrepancy. For command = "true;${IFS}whoami" and attacker-controlled user_input = "whoami", detect_shell_injection reaches contains_shell_syntax; the regex match is preceded by } and ends at the string terminus, so none of the literal boundary checks succeeds. The shell expands the unquoted ${IFS} and executes whoami as the command after true;. run_vulnerability_scan raises only when a detection result exists, so the false negative allows the shell sink to proceed in blocking mode. The same detector is used by both the os.system and shell-enabled subprocess.Popen integrations.