fix(export_document): harden wkhtmltopdf subprocess

[Vigneshsekar]

Summary

• restrict renderer lookup to the static wkhtmltopdf executable and validate its canonical path, permissions, basename, and symlink target
• explicitly disable shell execution and document the reviewed frappe-subprocess-exec call
• bound the render timeout and add regression coverage for option injection and executable substitution

Security review

The subprocess receives an argv list, never a shell command. Page size and orientation are allowlisted, margins and timeout are bounded integers, header/footer paths are internally generated absolute temp paths, and document HTML is passed on stdin rather than interpolated into argv.

Testing

• bench --site jarvis.localhost run-tests --app jarvis --module jarvis.tests.test_export_document_furniture (68 passed)
• bench --site jarvis.localhost run-tests --app jarvis --module jarvis.tests.test_export_document (56 passed)
• pre-commit run --files jarvis/tools/_export/document/furniture.py jarvis/tests/test_export_document_furniture.py