[release/10.0] Prevent format injection in hosting Windows PAL printf functions when redirected to file

[github-actions]

Backport of #119568 to release/10.0

/cc @jkoritzinsky @nike4613

Customer Impact

• Customer reported
• Found internally

Prevents environment variables with formating markup from being passed through to redirected output formatting.

Regression

• Yes
• No

This passthrough from environment variable is only possible in .NET 10.

Testing

Manual validation.

Risk

Low. Isolated fix.

IMPORTANT: If this backport is for a servicing release, please verify that:

• The PR target branch is release/X.0-staging, not release/X.0.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[dotnet-policy-service]

Tagging subscribers to this area: @vitek-karas, @agocke, @VSadov
See info in area-owners.md if you want to be subscribed.

[jkoritzinsky]

/backport to release/9.0

[github-actions]

Started backporting to release/9.0: https://github.com/dotnet/runtime/actions/runs/17781043673

[github-actions]

@jkoritzinsky backporting to "release/9.0" failed, the patch most likely resulted in conflicts:

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Prevent format injection in hosting Windows PAL printf functions when redirected to file
.git/rebase-apply/patch:20: trailing whitespace.
    
warning: 1 line adds whitespace errors.
Using index info to reconstruct a base tree...
M	src/native/corehost/hostmisc/pal.windows.cpp
Falling back to patching base and 3-way merge...
Auto-merging src/native/corehost/hostmisc/pal.windows.cpp
CONFLICT (content): Merge conflict in src/native/corehost/hostmisc/pal.windows.cpp
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Prevent format injection in hosting Windows PAL printf functions when redirected to file
Error: The process '/usr/bin/git' failed with exit code 128

Please backport manually!

[JulieLeeMSFT]

LGTM.

[agocke]

/ba-g failures are unrelated. Regex and apphost test failures.