Insecure command invocation in setup.py

[mhucka]

Describe the issue

CodeQL scanning reports a vulnerability in setup.py: https://github.com/quantumlib/qsim/security/code-scanning/51

        if not os.path.exists(self.build_temp):
            os.makedirs(self.build_temp)
        subprocess.check_call(
            ["cmake", ext.sourcedir] + cmake_args, cwd=self.build_temp, env=env

The check_call may allow the user to execute malicious code.

What version of qsim are you using?

0.23.0.dev0

How can the issue be reproduced?

No response