SSH command injection via unsanitized remote path in format! string

[consigcody94]

Found via code audit. crates/hstry-core/src/remote.rs:244-254. file_exists() and expand_remote_path() pass untrusted path into format!(test -f {remote_path}). Semicolons inject commands.