Opened PR #3304 to track xfails as we migrate from shell parsing to AST in the defense-in-depth security analyzer.