Fix shell injection vulnerability in environment variable handling

[ColeMurray]

Summary

This PR fixes a shell injection vulnerability in the setup_user_env function by replacing unsafe os.system() calls with direct file writing.

Changes

• Import shlex module for safe shell argument quoting
• Replace os.system() with open() for writing environment variables
• Use shlex.quote() to properly escape the CLEARML_AUTH_TOKEN value
• Use os.path.expanduser() for proper path handling

Security Impact

The previous implementation used os.system() with string formatting, which could allow shell command injection if the CLEARML_AUTH_TOKEN environment variable contained malicious shell metacharacters. This change eliminates that risk by writing directly to the file and properly quoting the token value.