fix Sys.command for windows: always escape cmd, wrap resulting command in quotes before executing (see #3402)