Unix `BROWSER` handling allows browser argument injection

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with splitasciiwhitespace. If an application passes an attacker-controlled non-HTTPS URL whose parsed form retains...