Have execve() escape double quotes in cmd.exe's preferred style

This makes it possible for us to use system() and popen() with paths
that redirect to filenames that contain spaces, e.g.

    system("echo.com hello >\"hello there.txt\"")

It's difficult to solve this problem, because WIN32 only allows passing
one single argument when launching programs and each program is allowed
to tokenize that however it wants. Most software follows the convention
of cmd.exe which is poorly documented and positively byzantine.

In the future we're going to solve this by not using cmd.exe at all and
instead embedding the cocmd.com interpreter into the system() function.
In the meantime, our documentation has been updated to help recalibrate
any expectation the user might hold regarding the security of using the
Windows command interpreter.

Fixes #644

libc/runtime/getdosargv.c

@@ -66,25 +66,23 @@ static textwindows noasan int Count(int c, struct DosArgv *st) {
   return n;
 }
 
-/**
- * Tokenizes and transcodes Windows NT CLI args, thus avoiding
- * CommandLineToArgv() schlepping in forty megs of dependencies.
- *
- * @param s is the command line string provided by the executive
- * @param buf is where we'll store double-NUL-terminated decoded args
- * @param size is how many bytes are available in buf
- * @param argv is where we'll store the decoded arg pointer array, which
- *     is guaranteed to be NULL-terminated if max>0
- * @param max specifies the item capacity of argv, or 0 to do scanning
- * @return number of args written, excluding the NULL-terminator; or,
- *     if the output buffer wasn't passed, or was too short, then the
- *     number of args that *would* have been written is returned; and
- *     there are currently no failure conditions that would have this
- *     return -1 since it doesn't do system calls
- * @see test/libc/dosarg_test.c
- * @see libc/runtime/ntspawn.c
- * @note kudos to Simon Tatham for figuring out quoting behavior
- */
+// Tokenizes and transcodes Windows NT CLI args, thus avoiding
+// CommandLineToArgv() schlepping in forty megs of dependencies.
+//
+// @param s is the command line string provided by the executive
+// @param buf is where we'll store double-NUL-terminated decoded args
+// @param size is how many bytes are available in buf
+// @param argv is where we'll store the decoded arg pointer array, which
+//     is guaranteed to be NULL-terminated if max>0
+// @param max specifies the item capacity of argv, or 0 to do scanning
+// @return number of args written, excluding the NULL-terminator; or,
+//     if the output buffer wasn't passed, or was too short, then the
+//     number of args that *would* have been written is returned; and
+//     there are currently no failure conditions that would have this
+//     return -1 since it doesn't do system calls
+// @see test/libc/dosarg_test.c
+// @see libc/runtime/ntspawn.c
+// @note kudos to Simon Tatham for figuring out quoting behavior
 textwindows noasan int GetDosArgv(const char16_t *cmdline, char *buf,
                                   size_t size, char **argv, size_t max) {
   bool inquote;

libc/runtime/getdosenviron.c

@@ -104,16 +104,14 @@ textwindows noinstrument noasan void FixPath(char *path) {
   }
 }
 
-/**
- * Transcodes NT environment variable block from UTF-16 to UTF-8.
- *
- * @param env is a double NUL-terminated block of key=values
- * @param buf is the new environment which gets double-nul'd
- * @param size is the byte capacity of buf
- * @param envp stores NULL-terminated string pointer list (optional)
- * @param max is the pointer count capacity of envp
- * @return number of variables decoded, excluding NULL-terminator
- */
+// Transcodes NT environment variable block from UTF-16 to UTF-8.
+//
+// @param env is a double NUL-terminated block of key=values
+// @param buf is the new environment which gets double-nul'd
+// @param size is the byte capacity of buf
+// @param envp stores NULL-terminated string pointer list (optional)
+// @param max is the pointer count capacity of envp
+// @return number of variables decoded, excluding NULL-terminator
 textwindows noasan noinstrument int GetDosEnviron(const char16_t *env,
                                                   char *buf, size_t size,
                                                   char **envp, size_t max) {