Switch to a compromise behavior in shell execution.

After powershell support was introduced in 0117c067e4fc67c6e2, we
stopped caring if the first word in a shell command was a valid
executable with an absolute path. This was in order to be able to use
shell builtins. However, it causes a behavior change in existing
policies that is potentially dangerous: Specifying a nonexisting
command would leave the variable unassigned with the old behavior,
whereas in the new behavior, the variable will contain the error
message from the shell.

Switching back to the old behavior will break shell builtins again, so
instead we do the compromise: Only look for an executable if the
command starts with an absolute filename. Since absolute filenames
were previously enforced, virtually all existing policies should have
them and therefore use the old behavior.

Solves issue 2738.