fix(security): replace shell=True with safe subprocess patterns in documentation

## Summary
Fix command injection vulnerabilities in documentation examples by replacing
shell=True with safe list-based subprocess calls.

## Changes

### alphafold-database/SKILL.md
- Replace shell=True with list-form subprocess.run()
- Add input validation for taxonomy_id parameter
- Add security warning note with link to Python docs

### modal/references/web-endpoints.md
- Replace shell=True with list-form subprocess.Popen()
- Add security warning note

## Security
These changes prevent potential command injection if users copy these examples
with untrusted input. The new patterns follow Python security best practices.

scientific-skills/modal/references/web-endpoints.md

@@ -131,6 +131,8 @@ def flask_app():
 
 For frameworks with custom network binding:
 
+> ⚠️ **Security Note**: The example below uses `shell=True` for simplicity. In production environments, prefer using `subprocess.Popen()` with a list of arguments to prevent command injection vulnerabilities.
+
 ```python
 @app.function()
 @modal.concurrent(max_inputs=100)
@@ -138,7 +140,8 @@ For frameworks with custom network binding:
 def my_server():
     import subprocess
     # Must bind to 0.0.0.0, not 127.0.0.1
-    subprocess.Popen("python -m http.server -d / 8000", shell=True)
+    # Use list form instead of shell=True for security
+    subprocess.Popen(["python", "-m", "http.server", "-d", "/", "8000"])
 ```
 
 ## Streaming Responses