fix: security and reliability improvements

[ianhandy]

Summary

I'm interested in helping maintain this project (ref #290). This PR demonstrates the kind of improvements I'd bring:

• Fix runString() temp path bug — tmpdir was used as a reference instead of tmpdir(), writing temp files to the wrong location (fixes the issue in Fix runString temp path to use tmpdir() and add regression test #320)
• Fix command injection vulnerability — checkSyntaxFile, getVersion, and getVersionSync used exec() with string interpolation, which is unsafe. Replaced with execFile() which passes args as an array
• Add temp file cleanup — runString() and checkSyntax() now clean up their temp .py files via .finally()
• Modernize internals — replaced custom extend() helper with Object.assign, updated minimum Node.js from 0.10 to 16
• Re-enable getVersion tests — these were disabled since getVersionSync test fails in appveyor #158 (AppVeyor-era). They pass on all platforms now
• Add GitHub Actions CI — matrix testing across Node 18/20/22, Python 3.10/3.12, on Ubuntu/macOS/Windows

All 45 tests passing (43 existing + 2 re-enabled).

Test plan

• All existing tests pass
• getVersion/getVersionSync tests re-enabled and passing
• Verified temp file cleanup works
• TypeScript compiles cleanly

[StantonMatt]

I took a triage pass on this because it is tied to #290. I don't think this is reviewable as one PR in its current shape: GitHub reports it as conflicting, and the diff combines several unrelated tracks: issue templates, GitHub Actions, AppVeyor, TypeScript conversion (index.js / test/test-python-shell.js removed and index.ts / test/test-python-shell.ts added), a package-lock replacement, README/changelog updates, temp-file cleanup, execFile hardening, and the runString() tmpdir fix.

The pieces that look easiest to make reviewable are the security/bug fixes split one at a time with focused tests:

• exec -> execFile for checkSyntaxFile, getVersion, and getVersionSync
• temp-file cleanup for runString() / checkSyntax()
• GitHub Actions CI as its own PR

The runString() tmpdir part is now covered separately by #330, so I would drop that from this branch to avoid overlap. I did not run local tests against this branch because the merge conflicts need to be resolved first.