Use subprocess securely

[Spencer Yu]

Due to https://docs.openstack.org/bandit/latest/plugins/subprocess_popen_with_shell_equals_true.html,
and reference https://security.openstack.org/guidelines/dg_avoid-shell-true.html and
https://security.openstack.org/guidelines/dg_use-subprocess-securely.html,
we should use python pipes to avoid shells and use subprocess more securely.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/520013

[OpenStack Infra (hudson-openstack)]

Change abandoned by Matt Riedemann (<email address hidden>) on branch: master
Review: https://review.opendev.org/520013
Reason: This looks abandoned so I'm going to drop it. This is also only modifying essentially tool/script code, not production runtime code, so it's very low priority to fix this IMO.

[Matt Riedemann (mriedem)]

I'm going to invalidate this because the code being pointed out is just dev/test scripts, not production runtime code. It can be fixed if someone wants to restore and rework the patch but it's super low priority IMO.