security: Fix command injection vulnerability in updater.py

- Add shlex.quote() on all path arguments before subprocess calls (lines 404-407)
- Consolidate duplicated version_compare() function into single module-level utility
- Remove three identical class methods from UpdateCheckThread, LocalPendingUpdateCheckThread, and UpdateManager
- Add comprehensive test suite for updater.py security-critical functionality
- Add requirements-dev.txt with pytest dependency

Addresses critical security findings from flares_audit_report.md:
  S001: Command Injection in Updater (CVSS ~7.5)
  Q001: Duplicated version_compare logic
  T001: Insufficient test coverage for updater.py

requirements-dev.txt

@@ -0,0 +1,6 @@
+# Development Dependencies
+
+These dependencies are for development, testing, and CI/CD only.
+Do not install in production environment.
+
+pytest>=7.0.0