Proper escaping of command line args + forward stdin

This pull request

- allows `ccjs` to read from stdin
- uses `child_process.spawn`, which allows for proper escaping of shell arguments. E.g.: `--output_wrapper="(function(){%output%}());"` works now.