Security Fix: Enforce strict validation for FFmpeg binary paths

[RinCodeForge927]

Fixes a potential command injection vulnerability by enforcing strict validation on external binary paths.

Previously, exec.Command accepted paths without verification, creating an attack vector if variables were compromised. I've introduced a ValidateExecutable function to ensure that:

1. Paths are absolute and point to existing files.
2. Files have executable permissions (on *nix).
3. Filenames match strictly allowlisted binaries (ffmpeg, ffprobe).

This validation is now applied across ffmpeg.go, filemanager.go, and metadata.go before any subprocess execution.