[3.11] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170)

[3.11] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170) #189163