feat!: replace shelljs.exec with child_process.spawnSync

[dpogue]

This drops the very old shelljs dependency in favour of NodeJS built-ins.

Moving from string commands to array arguments also increases safety by reducing the potential for argument injection attacks.

I flagged this as a major version bump, since we directly return the output of shell.exec or child_process.spawnSync and there are some differences in the return values (most notably the code property is now status).

[erisu]

LGTM