Send the 802.1X password over stdin instead of argv

argv is world-readable in /proc for every local process while the
connection attempt runs. Create the profile without the secret, then
set it through nmcli's scriptable connection editor, which reads from
stdin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shell/plugins/panels/network/Model.js

@@ -232,11 +232,16 @@ function isProtected(security, openSecurity) {
   return security !== openSecurity
 }
 
+// The password arrives on stdin and reaches nmcli through the scriptable
+// `connection edit` editor -- argv is world-readable in /proc, so the secret
+// must never be an argument (printf is a bash builtin, so no process spawns
+// with it either).
 var enterpriseConnectScript =
-  "u=$(uuidgen);" +
+  "u=$(uuidgen); IFS= read -r pw;" +
   " nmcli connection add type wifi con-name \"$1\" ssid \"$1\" connection.uuid \"$u\"" +
   " wifi-sec.key-mgmt wpa-eap 802-1x.eap peap 802-1x.phase2-auth mschapv2" +
-  " 802-1x.identity \"$2\" 802-1x.password \"$3\" 802-1x.auth-timeout 8" +
+  " 802-1x.identity \"$2\" 802-1x.auth-timeout 8 >/dev/null" +
+  " && printf 'set 802-1x.password %s\\nsave\\nquit\\n' \"$pw\" | nmcli connection edit uuid \"$u\" >/dev/null" +
   " && nmcli connection up uuid \"$u\"" +
   " || { nmcli connection delete uuid \"$u\" >/dev/null 2>&1; false; }"