SECURITY FIX

A change in Src/menustats.c replaces the code that builds a wget
commandline and gives it to a shell using system().  The new code
uses execvp() and no shell.  The WIN32 code for this section is not
changed.

This change removes a security flaw where if the pinger list combined
shell commands with the URL for file retrieval they would be run with
possible serious results (such as mailing a private key to attacker).
This code seems to have been present since 1998.

example bad line in allpingers.txt:
rlist = http://www.tahina.priv.at/~cm/stats/rlist.txt;/usr/bin/touch /tmp/BUGBUG;

bug description:
https://www.owasp.org/index.php/Top_10_2013-A1-Injection

To get an attacker's URL into the allpingers.txt file it could either be
distributed from http://www.noreply.org/ or the HTTP requests made
periodically to http://www.noreply.org/ could be intercepted by an
active attack (https://www.schneier.com/essay-455.html).