Merge upstream puppeteer 22.15.0

[ruifigueira]

What kind of change does this PR introduce?

Did you add tests for your changes?

If relevant, did you update the documentation?

Summary

Does this PR introduce a breaking change?

Other information

In general, the fix is to avoid letting untrusted or library-controlled data be interpreted by a shell. For Node’s child_process, that means using spawn/spawnSync with shell: false (the default) and passing arguments as an array, or using execFile instead of exec. If you truly need shell features like pipes or redirection, input must be carefully quoted/escaped with something like shell-quote.

In this specific case, runSetup only needs to run setup.exe with a single argument --configure-browser-in-directory=<browserDir>. There is no need for shell features, so we can safely call spawnSync directly with shell: false. Since spawnSync is already called with the program path and an array of arguments, the minimal fix is:

• Remove the { shell: true } option so the shell is not involved.
• Optionally (but not strictly necessary for correctness), we can pass the argument as a full string as we already do: `--configure-browser-in-directory=` + browserDir. spawnSync will handle it as one argument.

This preserves existing functionality (invoking setup.exe with the same argument) while preventing any shell interpretation of browserDir. No additional imports, methods, or dependencies are required. All changes occur in packages/browsers/src/install.ts within the runSetup function.