KEY SECURITY IMPROVEMENTS:

1. wgrib2_idx():
   - Changed from: subprocess.run(f"{wgrib2} -s {grib2filepath}", shell=True)
   - Changed to: subprocess.run([wgrib2, "-s", str(grib2filepath)])
   - Benefit: Prevents shell injection attacks

2. Subset with requests:
   - Pure Python, no external curl dependency
   - More portable across platforms
   - Better error handling
   - Easier to test

WHY THIS MATTERS:
- If grib2filepath contains special characters like "; rm -rf /"
  the old version would execute that command
- The new version treats all inputs as data, not code
- This is especially important if filepath comes from user input

MIGRATION NOTES:
- The new version has identical functionality
- Error messages are now more descriptive
- No changes needed to calling code
- Add timeout parameter to subprocess calls if needed