yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

SummaryThe patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes.However, this escaping is not sufficient, and still allows expansion of environment variables.Support for output template expansion in --exec, along...