[DEP0190] DeprecationWarning when spawning npm with shell: true on Windows

[hombach]

Describe the bug

When running adapter integration tests on Windows with Node.js ≥ 22, the following deprecation warning appears:

(node:XXXX) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true
can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
Root cause

PR #595 introduced shell: true for spawning npm on Windows to work around a Windows security update (April 2024) that broke .cmd/.bat execution. This fix is correct and necessary, but newer Node.js versions now emit DEP0190 when arguments are passed to a child process launched with shell: true.

Steps to reproduce

Use any ioBroker adapter with @iobroker/testing
Run npm run test:integration on Windows with Node.js ≥ 22
Observe the DEP0190 warning during adapter startup
Expected behavior

No deprecation warning.

Possible fix

Instead of shell: true with arguments as an array, pass the full command as a single string when shell: true is used on Windows:

// Instead of:
spawn('npm', ['install', '--production'], { shell: true })

// Use:
spawn('npm install --production', [], { shell: true })
// or:
spawn('npm install --production', { shell: true })
This avoids the argument-concatenation path that triggers DEP0190 while keeping the Windows .cmd compatibility.

Environment

@iobroker/testing: latest
Node.js: ≥ 22
OS: Windows
Related: PR #595