chore: Fix datadog vulnerabilities (off-ticket)

[JohnStainsby]

Addresses critical and high vulnerabilities reported in DataDog

• Double quoting bash variables
• Don't use empty list as default initialiser
• Don't parse ps output through test tools

---

Checklist:

Title:

• Conforms to our pull request title guidance. E.g. feat: Add new feature (DBTP-1234) or chore: Correct typo (off-ticket)

Description:

• Link to ticket included (unless it's a quick out of ticket thing)
• Includes tests (or an explanation for why it doesn't)
• If the work includes user interface changes, before and after screenshots included in description
• Includes any applicable changes to the documentation in this code base
• Includes link(s) to any applicable changes to the documentation in the DBT Platform Documentation (can be to a pull request)

Tasks:

• Run the end to end tests for this branch and confirm that they are passing

Reviewer Checklist

• I have reviewed the PR and ensured no secret values are present

[github-actions]

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Scanned Files

None

[kierdavis]

Can we fix these rather than suppressing the alerts? Or at least put a ticket on the backlog to come back to them?

[JohnStainsby]

The warning for manage_users is a false positive. All of the copilot commands are no longer used the long term fix would be to remove them all, I'll check if there is a ticket for that cleanup task.

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage