Fix Command Injection

The function below builds a shell command string by concatenating a filename into it — the kind of string a naive subprocess.run(cmd, shell=True) call would execute.

The bug: an attacker can pass "report.txt; rm -rf /" as the filename. When run with shell=True, the shell treats ; as a command separator and executes both commands.

Your task: fix solve(filename) so it returns an argument list — ['cat', filename] — instead of a shell string. Passed to subprocess.run(argv, shell=False), the filename is treated as a single literal argument no matter what characters it contains; there's no shell to interpret ;, $(), or &&.

solve('report.txt')        # → ['cat', 'report.txt']
solve('file; rm -rf /')    # → ['cat', 'file; rm -rf /']   (one argument, not two commands)