child_process: validate shell option in normalizeExecArgs()

- narrow validation type to string (previously de facto not validated)
- ensure empty string is coerced to true

lib/child_process.js

@@ -196,7 +196,12 @@ function normalizeExecArgs(command, options, callback) {
 
   // Make a shallow copy so we don't clobber the user's options object.
   options = { __proto__: null, ...options };
-  options.shell = typeof options.shell === 'string' ? options.shell : true;
+
+  // Validate the shell, if present, and ensure a truthy value.
+  if (options.shell != null) {
+    validateString(options.shell, 'options.shell');
+  }
+  options.shell ||= true;
 
   return {
     file: command,