security: fix remaining subprocess vulnerabilities in container_dispatcher.py

- Add validation to handle_multi() push parameter
- Use static script paths to prevent path injection
- Validate boolean type for push parameter
- Addresses remaining Semgrep subprocess security warnings

Fixes: Semgrep alert 1211 (remaining subprocess calls)

Author: fgogolli

dev-tools/container/container_dispatcher.py

@@ -59,8 +59,10 @@ def handle_version():
 
 def handle_run():
     """Handle run command."""
+    # Static script path - no user input validation needed
+    script_path = "./dev-tools/scripts/container_build.sh"
     try:
-        subprocess.run(["./dev-tools/scripts/container_build.sh"], check=True)
+        subprocess.run([script_path], check=True)
         return 0
     except subprocess.CalledProcessError as e:
         return e.returncode
@@ -99,7 +101,13 @@ def handle_single():
 
 def handle_multi(push):
     """Handle multi-platform build."""
-    cmd = ["./dev-tools/scripts/container_build.sh"]
+    # Validate push parameter
+    if not isinstance(push, bool):
+        raise ValueError(f"Invalid push parameter: {push}")
+    
+    script_path = "./dev-tools/scripts/container_build.sh"
+    cmd = [script_path]
+    
     if push:
         os.environ["PUSH"] = "true"