Use execFile instead of exec when installing deps in build (#16587)

* Clarify lockfile is used for resolution

* Use 'execFile' instead of 'exec'

tasks/build/install_dependencies.js

@@ -1,4 +1,4 @@
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 module.exports = function (grunt) {
   grunt.registerTask('_build:installDependencies', function () {
     // We rely on a local version of Yarn that contains the bugfix from
@@ -9,8 +9,9 @@ module.exports = function (grunt) {
     // We're using `pure-lockfile` instead of `frozen-lockfile` because we
     // rewrite `link:` dependencies to `file:` dependencies earlier in the
     // build. This means the lockfile won't be consistent, so instead of
-    // verifying it, we just skip writing a new lockfile.
-    exec(`${yarn} --production --ignore-optional --pure-lockfile`, {
+    // verifying it, we just skip writing a new lockfile. However, this does
+    // still use the existing lockfile for dependency resolution.
+    execFile(yarn, ['--production', '--ignore-optional', '--pure-lockfile'], {
       cwd: grunt.config.process('<%= root %>/build/kibana')
     }, this.async());
   });