GHSA-xw67-cg5f-4m2r: AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

AVideo has a command injection vulnerability in `plugin/Live/on_publish.php` where user-controlled stream keys are inserted into a shell command using literal single quotes instead of proper escaping. An attacker can break out of the quotes by including a single quote character in the stream key, allowing them to inject and execute arbitrary shell commands on the server.