Remove use of exec('rm -Rf') as security concern preventing use of open_basedir.

Thanks for working on this. The same code is still in D11 (see here: https://git.drupalcode.org/project/drupal/-/blob/11.x/core/modules/syste...), so according to the backport policy, I am changing the version.

It'd be a good idea to replace this, but now there's an SSH class that has things like ssh2_exec($this->connection, 'rm -Rf ' . escapeshellarg($directory)). There's no check if $directory is '/', '/bin', 'bin', '/home/*', etc. That code is in the removeDirectoryJailed method so presumably it's only allowed to operate within a specific directory.

Also, the vendor directory for D11 dev is chock full of calls to exec() and shell_exec(). Symfony even includes an .exe file.