Use %COMSPEC% not "cmd" to prevent hijacking. Fixes #5254 (#5255)

* Use %COMSPEC% not "cmd" to prevent hijacking. Fixes #5254

* Update aliases.py

* Update aliases.py

---------

Co-authored-by: Andy Kipp <anki-code@users.noreply.github.com>

xonsh/aliases.py

@@ -894,7 +894,7 @@ def make_default_aliases():
             "vol",
         }
         for alias in windows_cmd_aliases:
-            default_aliases[alias] = ["cmd", "/c", alias]
+            default_aliases[alias] = [os.getenv("COMSPEC"), "/c", alias]
         default_aliases["call"] = ["source-cmd"]
         default_aliases["source-bat"] = ["source-cmd"]
         default_aliases["clear"] = "cls"