fix: security and reliability improvements

[ianhandy]

Summary

I'm interested in helping maintain this project (ref #290). This PR demonstrates the kind of improvements I'd bring:

• Fix runString() temp path bug — tmpdir was used as a reference instead of tmpdir(), writing temp files to the wrong location (fixes the issue in Fix runString temp path to use tmpdir() and add regression test #320)
• Fix command injection vulnerability — checkSyntaxFile, getVersion, and getVersionSync used exec() with string interpolation, which is unsafe. Replaced with execFile() which passes args as an array
• Add temp file cleanup — runString() and checkSyntax() now clean up their temp .py files via .finally()
• Modernize internals — replaced custom extend() helper with Object.assign, updated minimum Node.js from 0.10 to 16
• Re-enable getVersion tests — these were disabled since getVersionSync test fails in appveyor #158 (AppVeyor-era). They pass on all platforms now
• Add GitHub Actions CI — matrix testing across Node 18/20/22, Python 3.10/3.12, on Ubuntu/macOS/Windows

All 45 tests passing (43 existing + 2 re-enabled).

Test plan

• All existing tests pass
• getVersion/getVersionSync tests re-enabled and passing
• Verified temp file cleanup works
• TypeScript compiles cleanly

[StantonMatt]

I took a triage pass on this because it is tied to #290. I don't think this is reviewable as one PR in its current shape: GitHub reports it as conflicting, and the diff combines several unrelated tracks: issue templates, GitHub Actions, AppVeyor, TypeScript conversion (index.js / test/test-python-shell.js removed and index.ts / test/test-python-shell.ts added), a package-lock replacement, README/changelog updates, temp-file cleanup, execFile hardening, and the runString() tmpdir fix.

The pieces that look easiest to make reviewable are the security/bug fixes split one at a time with focused tests:

• exec -> execFile for checkSyntaxFile, getVersion, and getVersionSync
• temp-file cleanup for runString() / checkSyntax()
• GitHub Actions CI as its own PR

The runString() tmpdir part is now covered separately by #330, so I would drop that from this branch to avoid overlap. I did not run local tests against this branch because the merge conflicts need to be resolved first.

[PNHD]

One additional correctness/concurrency blocker beyond the existing scope/conflict triage: this branch replaces the existing random temp-file suffix with Date.now() in both checkSyntax() and runString().

Two calls started within the same millisecond can therefore select the same path. For runString(), the second writeFileSync() can overwrite the first call's script before Python has consumed it; with the new .finally() cleanup, either call can also unlink the shared path while the other still needs it. checkSyntax() has the same collision class.

Please keep a collision-resistant unique suffix (the focused #330 fix preserves the existing random suffix), or use a proper unique-temp-file primitive, and add a concurrent-call regression before merging this part.