fix: Fix command injection vulnerability in upload_package_repo.py

[raramakr]

Refactor run_command() to prevent shell injection attacks:

• Accept list[str] instead of string commands with shell=True
• Add stdout parameter for file redirects instead of shell redirection
• Add type hints and docstring

Additional improvements:

• Add encoding="utf-8" to all text file operations
• Convert os.path usage to pathlib.Path for consistency

JIRA ID: https://amd-hub.atlassian.net/browse/ROCM-26880

[therock-pr-bot]

❌ PR Check — Action Required

Check	Status	Details
🌿 Branch Name	✅ Pass	—
📝 PR Title/Description	✅ Pass	—
⛔ Forbidden Files	✅ Pass	—
🧪 Unit Test	❌ Fail	Error: Source/code files changed without an accompanying unit test. Expected: add at least one test file named like test_<name>.py / test_<name>.cpp (or <name>_test.*). Current: code file(s) changed: build_tools/packaging/linux/upload_package_repo.py; no test file found
🔎 pre-commit	✅ Pass	—
🚫 Draft PR	🔜 To Be Enabled	—
🚩 Feature Flag	🔜 To Be Enabled	—
📊 Code Coverage	🔜 To Be Enabled	—

⚠️ 1 policy check(s) failed. Please address the issues above before this PR can be Reviewed.

🚫 Please fix the failed policies

• ❌ Unit Test

The Not ready to Review label was added to this PR. Once all policies pass, the label is removed automatically.

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

[therock-pr-bot]

🚫 Please fix the failed policies before requesting reviews.

The following policy checks failed:

• ❌ Unit Test

The Not ready to Review label has been added to this PR.
Once all policies pass, the label will be removed automatically.

[nunnikri]

Looks good to me. Lets complete the ci run