fix(kubernetes): prevent command injection in application remove

[hlts2]

What this does

Removes a shell-based command construction in civo kubernetes applications remove that interpolated the user-supplied application name into a string passed to /bin/bash -c, which allowed shell command injection.

Changes

• Fetch the marketplace uninstall.sh over HTTP and pipe it to bash -s via stdin, instead of building a bash <(curl ...) string for /bin/bash -c.
• The application name is now URL-escaped (url.PathEscape) and only ever used as a URL path segment — it never reaches a shell command string.
• Validate the HTTP status before executing, so a missing script (404) is no longer piped to the shell.
• Extract the fetch into getMarketplaceAppUninstallScript(baseURL, appName) and add a table-driven test using an httptest server.

Notes

• The uninstall flow and its error output are otherwise unchanged.

[hlts2]

Manual verification

Confirmed the normal install/uninstall flow still works end-to-end (k3s cluster).

Install keda:

❯ civo kubernetes applications add keda --cluster hiroto-k3s-1-36-0
The application was installed in the Kubernetes cluster hiroto-k3s-1-36-0

❯ helm list -n keda
NAME    NAMESPACE    REVISION    UPDATED                                    STATUS      CHART          APP VERSION
keda    keda         1           2026-06-22 08:41:53.773248355 +0000 UTC    deployed    keda-2.16.1    2.16.1

→ actually installed.

Remove keda:

❯ civo kubernetes applications remove keda --cluster hiroto-k3s-1-36-0

❯ helm list -n keda
NAME    NAMESPACE    REVISION    UPDATED    STATUS    CHART    APP VERSION

→ the release is gone.

[hlts2]

When no official uninstall.sh exists

If the marketplace app has no uninstall.sh upstream, the command still errors out as before — it does not silently report success.

❯ civo kubernetes applications remove metrics-server --cluster hiroto-k3s-1-36-0
Error: Failed to get uninstall script: uninstall script for application metrics-server not found (HTTP 404)