Restrict shell commands by default

Restrict shell commands by default

Before it's too late, let's boil the oceans
and just do it. This patch assumes that old code
calling wfShellExec() doesn't know about restrictions
so it doesn't restrict anything. New code, however,
needs to specify its restrictions or deal with defaults.

Change-Id: I58963901087202d4a405bcdb6bd12758bb6b0ff7