Issue #22636: Merge ctypes.util shell injection fixes from 3.5

diff --cc Lib/ctypes/util.py
Simple merge

diff --cc Misc/NEWS
index c59b3adf01b7a030a2f64e4d53ec25baa8a55e1b,14fd2472131cb0e630c4cb92b88807c59d499560..df29fb26ce8b5e25b8b23a5769e70960a2b7076f
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -2,14 -2,20 +2,17 @@@
  Python News
  +++++++++++
  
 -What's New in Python 3.5.3 release candidate 1?
 -===============================================
 -
 -Release date: TBA
 +What's New in Python 3.6.0 alpha 3
 +==================================
  
 -Core and Builtins
 ------------------
 +*Release date: XXXX-XX-XX*
  
  Library
 --------
 ++++++++
  
+ - Issue #22636: Avoid shell injection problems with
+   ctypes.util.find_library().
+ 
  - Issue #16182: Fix various functions in the "readline" module to use the
    locale encoding, and fix get_begidx() and get_endidx() to return code point
    indexes.