fix(security): shell escape paths in HostDiskUsageService; null-prototype objects in batch parser (#2659)

* fix(core): escape path in HostDiskUsageService

* fix: always use null prototypes on operation specs

* fix: update test.yml so that tests work again

.github/workflows/test.yml

@@ -30,7 +30,9 @@ jobs:
         env:
           NODE_OPTIONS: --max-old-space-size=4096
         run: |
-          npm ci
+          rm package-lock.json
+          npm install -g npm@latest
+          npm install
           npm run build
           npm run test:backend -- --coverage --coverage.reporter=json --coverage.reporter=json-summary --coverage.reporter=lcov