[3.14] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170)

[3.14] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check (GH-148170) #189159