Fix shell-injection in LicenseHeaderStep SET_FROM_GIT mode

[nedtwigg]

Summary

• LicenseHeaderStep.parseYear() was concatenating file.getAbsolutePath() into a shell string and running it via bash -c / cmd /c. A file in a processed repository whose name contained shell metacharacters (e.g. foo`whoami`.java, foo;rm -rf ~.java, Windows foo&calc.exe.java) could execute arbitrary commands as the user running Spotless — a real risk on dev workstations and CI workers that run spotlessApply / spotless:apply against untrusted repos in SET_FROM_GIT year mode.
• Fix: invoke git directly via ProcessBuilder with an explicit argument list. No shell, no concatenation, no per-OS branch. The -- separator is preserved so paths starting with - aren't interpreted as flags.
• Side benefit: paths with spaces — which were silently broken under the old bash -c form because the shell would word-split them — now work correctly.

Test plan

• ./gradlew :lib:compileJava (verified locally)
• ./gradlew :testlib:test --tests '*LicenseHeader*' passes
• Manual: run spotlessApply against a repo containing a file with shell metacharacters in its name and confirm no command execution