Allocate the flag str so it persists beyond the exec call

[sethvargo]

There exists a race where the result of c_str() isn't safe after the line ends. This fixes that and also formats the args how Go likes args to be.