Supply chain: Remove the dependency on subprocess

[lars-t-hansen]

This is lingering work after #152 and there's some preliminary work (really just comments) on w-194-subprocess in my fork of this repo: We want to remove the dependency on the subprocess crate, which we are now touching only very lightly in command.rs. The subprocess crate is permissively licensed and we can crib code if we want.

This is not urgent - we've pinned the version of subprocess in Cargo.toml and we're at very limited risk for supply chain attacks through the existing dependency. But it's nice to not have to worry.