add py/shell-command-constructed-from-input, but without a source.

It's a very direct port from Ruby, with only minor adjustments to fit the Python APIs

python/ql/src/Security/CWE-078/examples/unsafe-shell-command-construction_fixed.py

@@ -0,0 +1,4 @@
+import subprocess
+
+def download (path): 
+    subprocess.run(["wget", path]) # OK