[security][3.4] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) (#2362)

* [3.4] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325)

Prevent passing other invalid environment variables and command arguments..
(cherry picked from commit d174d24a)

* Update NEWS