fix: bypass default-browser PATH hijack on Windows for --private @W-23807283@

[WillieRuemmele]

Summary

• On Windows, sf org open --private calls the default-browser npm package which invokes bare reg (no fully-qualified path), allowing a malicious repo-local reg.exe to execute via PATH hijack
• This PR bypasses default-browser entirely on Windows by detecting the default browser ourselves using a fully-qualified %SYSTEMROOT%\System32\reg.exe path, then passing an explicit app name + incognito flag to open() (which skips default-browser for any concrete app name)
• Mirrors the safe pattern from wsl-utils's powerShellPath() which already qualifies system binary paths

Work Item

@W-23807283@: SF CLI - Project-local reg.exe leads to RCE during private org opening

Test plan

• Unit tests for getWindowsPrivateBrowserApp() covering Chrome, Firefox, Edge, Brave, hyphen-suffixed ProgIds, unsupported browsers, and unparseable output
• Unit test verifying the fully-qualified path uses SYSTEMROOT env var
• Windows-only NUT that verifies a poisoned PATH does not result in execution of a local reg.exe
• Manual verification on Windows with a repo containing node_modules/.bin/reg.cmd