[Aikido] Fix shell injection bypass via backtick operator in HookAst.cpp

[aikido-autofix]

This patch addresses a shell injection vulnerability where PHP backtick operators bypassed shell-injection interception by transforming ZEND_AST_SHELL_EXEC nodes into shell_exec() function calls at the AST processing level. The fix ensures backtick expressions are subject to the same security hooks and EVENT_PRE_SHELL_EXECUTED emission as explicitly invoked shell functions. Changes were made to lib/php-extension/HookAst.cpp to implement the AST transformation logic.

✅ 1 issue fixed by this PR

Issue	Severity	Description
CodeAudit#811697531	HIGH	The shell-execution registration table contains handlers for exec, shell_exec, system, passthru, popen, and proc_open, while the generic dispatcher selects handlers only by the invoked function name. PHP backticks are a language-level shell-execution construct rather than a call to the registered shell_exec function, so this function-hook path does not emit EVENT_PRE_SHELL_EXECUTED. Consequently, an application route that embeds request data in a backtick command can execute injected shell syntax despite the extension's shell-injection blocking mode.