gifn-apply: use Ruff 0.1.13, disable some subprocess checks

We try to be responsible in our command invocation.

Also, drop the PLE1205 override: it does seem to have been a false
positive fixed in a later version of Ruff.

Ruff: S603,S607
Change-Id: I356cc28b53e503a0e7c898e5a5b8e549621ac479
diff --git a/tools/git-if-needed/python/gifn_apply/git.py b/tools/git-if-needed/python/gifn_apply/git.py
index 038d167..f19efab 100644
--- a/tools/git-if-needed/python/gifn_apply/git.py
+++ b/tools/git-if-needed/python/gifn_apply/git.py
@@ -44,7 +44,7 @@
     )
     try:
         subprocess.run(
-            ["git", "clone", repo_url.geturl(), repo.repo, "-b", "master"],
+            ["git", "clone", repo_url.geturl(), repo.repo, "-b", "master"],  # noqa: S603,S607
             check=True,
             cwd=repo_dir.parent,
         )
@@ -65,10 +65,10 @@
         lines = [
             line
             for line in subprocess.check_output(
-                ["git", "log", "--pretty=%(trailers:key=Change-Id)", "--reverse"],
+                ["git", "log", "--pretty=%(trailers:key=Change-Id)", "--reverse"],  # noqa: S607
                 cwd=repo_dir,
                 encoding="UTF-8",
-                shell=False,
+                shell=False,  # noqa: S603
             ).splitlines()
             if line
         ]