Fix issue where commands could be injected running on Cocoapods projects

Thanks to Joern SchneeweiszStaff Security Engineer, Security Research | GitLab for raising the issue

lib/license_finder/package_managers/cocoa_pods.rb

@@ -53,7 +53,7 @@ def acknowledgements_path
     end
 
     def read_plist(pathname)
-      JSON.parse(`plutil -convert json -o - '#{pathname}'`)
+      JSON.parse(`plutil -convert json -o - '#{pathname.gsub!(/[^0-9A-Za-z.\-]/, '')}'`)
     end
   end
 end