[3.13] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170)

[3.13] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170) #254030