Kill the Shell Injection

Implement build_ffmpeg_cmd(filename: str) returning the SAFE argv LIST form for converting a video: ['ffmpeg', '-i', filename, filename + '.mp4']. Then implement run_demo(filename) that would execute it via subprocess.run(cmd) WITHOUT shell=True and without any f-string in the command construction (graders check the source). Return the command list from build_ffmpeg_cmd.

Difficulty: intermediate