fix: handle proper tokenization for --extra-params flag

[valeriobelli]

Summary

--extra-params was split naively on spaces (val.split(' ')), which broke any argument containing a legitimate space and leaked the quote characters through, e.g.:

  --extra-params='-destination "iOS Simulator" CODE_SIGNING_ALLOWED=NO'
  --extra-params='EXCLUDED_ARCHS="arm64 i386"'

Replace the split with a shared, quote-aware tokenize utility in cli-tools. It honors single/double quotes, joins adjacent quoted and unquoted segments into one token, and does no shell interpretation; values like OTHER_LDFLAGS=$(inherited) and Windows Gradle paths (C:\keys\app.jks) reach the tool verbatim. Empty/whitespace-only arguments yield no arguments, and an unterminated quote throws a clear error.

Wired into XcodeBuild (buildOptions) and Gradle (buildAndroid, which is also reused by run-android command). The Xcode build log now quotes arguments containing whitespace so it stays copy-pasteable.

Additionally, the apple-related buildProject function accounts for this change when printing the generated xcodebuild command, enabling effective copy-and-paste.

I've evaluated shell-quote (https://www.npmjs.com/package/shell-quote), which is also a transitive dependency of @react-native-community/cli-tools.

The reason why I considered shell-quote not fitting is that it structurally recognizes operators (;, |), command substitution ($(...)), and globs (*), returning them as {op}/{op:'glob'} objects, and this cannot be disabled by any option. Realistic xcodebuild values such as OTHER_LDFLAGS=$(inherited) are therefore mangled. By keeping the solution close to the current one, we require removal of verbatim quotes and field splitting, with the payload left untouched and close to the current splitting strategy. A minor bonus is that our utility throws a clear CLIError on an unterminated quote, whereas shell-quote drops it silently.

Another minor decision against shell-quote was about the recent CVE, although it impacted the quote function instead of the parse function we could have eventually used.

We can still use shell-quote as an alternative strategy, since the dependency remains usable if the project later accepts post-processing its output and the operator caveat applies, but for this use case, a focused utility is simpler and more correct.

Test Plan

Added tests in packages/cli-tools/src/__tests__/tokenizeCommand.test.ts asserting some use cases.

$ jest packages/cli-tools/src/__tests__/tokenize.test.ts
 PASS   unit  packages/cli-tools/src/__tests__/tokenize.test.ts
  tokenize
    ✓ splits space-separated xcodebuild arguments (1 ms)
    ✓ splits space-separated gradle properties
    ✓ keeps a double-quoted xcodebuild destination with spaces in one token
    ✓ keeps a single-quoted destination specifier with spaces in one token
    ✓ strips the surrounding quotes from a quoted path containing a space
    ✓ joins an unquoted build-setting name with its quoted, space-containing value
    ✓ collapses extra whitespace (spaces and tabs) between arguments
    ✓ passes xcodebuild build-setting syntax such as $(inherited) through verbatim
    ✓ preserves backslashes inside single quotes so Windows gradle paths survive
    ✓ throws on a lone unquoted apostrophe
    ✓ parses a quoted Gradle property value containing an apostrophe
    ✓ returns an empty array for empty input
    ✓ returns an empty array for whitespace-only input (1 ms)
    ✓ keeps an explicit empty quoted argument
    ✓ throws on an unterminated double quote
    ✓ throws on an unterminated single quote
    with POSIX backslash escaping (non-Windows)
      ✓ treats an unquoted backslash as an escape that preserves the next character
      ✓ escapes an apostrophe with a backslash outside quotes
      ✓ unescapes quotes inside double-quoted JSON values
      ✓ keeps backslashes literal inside double-quoted values
    on Windows
      ✓ keeps unquoted backslashes literal so native paths survive
      ✓ keeps backslashes literal inside double-quoted values

Test Suites: 1 passed, 1 total
Tests:       22 passed, 22 total

Checklist

• Documentation is up to date.
• Follows commit message convention described in CONTRIBUTING.md.
• For functional changes, my test plan has linked these CLI changes into a local react-native checkout (instructions).