[3.12] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170)

[3.12] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170) #285905