Don't use `shell=True` when calling subprocess.Popen.

Using `shell=True` opens the door to argument quoting issues and little Bobby Tables (http://www.xkcd.com/327/).  It's unnecessary, let's not do it.

(The salt deploy commands still seem to use magic commas, so if your repo name contains a comma you will probably have a Bad Day.  But otherwise we should be pretty robust against strange tag and repo names now.)