Don't allow forwarding env vars in server-side batch changes
Created by: mrnugget
This is part of #26929 (closed) since building the cache key relies on env vars and we want to avoid the env-var forwarding to go into SSBC.
It also fixes a duplicate comment in the batch spec schema, copying in the description from our official docs.