fix: harden pip shell commands

[damacus]

Summary

• Build pip command lines from argument arrays with Shellwords
• Split options safely and drop empty mode arguments
• Escape virtualenv pip executable and package arguments

Verification

• cookstyle libraries/helpers.rb resources/pip.rb
• ruby -c libraries/helpers.rb
• ruby -c resources/pip.rb