Document Windows stdio command-shell parsing

[andyst-dev]

Summary

• document on the public Command and Arguments API that Windows stdio launches are routed through cmd.exe /c
• clarify that list-shaped arguments are still interpreted by the Windows command shell
• add a security warning to the stdio transport guide describing the SDK's limited escaping and recommending validation or allowlisting

Motivation

Callers can otherwise reasonably assume that Arguments reaches the child as an argv vector without shell interpretation. On Windows, that assumption is false for commands other than cmd.exe, which can invalidate command-injection threat models.

Fixes #1751.

Validation

• dotnet build — 0 warnings, 0 errors
• make generate-docs — DocFX completed with --warningsAsErrors true, 0 warnings, 0 errors
• git diff --check