substituteAll: Enumerate environment variables more reliably

Getting the names of all environment variables is tricky. The previous
implementation easily got confused by multi-line variables. The new
one is more reliable but not still not perfect.

This works around a segfault in Bash 4.3, where the expression
"${!var}" (where var="-9") crashes under certain conditions.

http://hydra.nixos.org/build/16693445