Logging and Preventing wsl -u root --exec commands from PowerShell and CMD

**Is your feature request related to a problem? Please describe.**
We want to prevent the usage of root account in our WSL Setup. When a user is using `wsl -u root --exec` the command is not logged and can not be audited. As far as we know there is only a way to prevent this using eventmonitor triggers (log inspect).

**Describe the solution you'd like**
There should be a way to block these Commands either from Windows-Side or the WSL to prevent them from being executed. Also there should be a way to log these or audit them in any way. E.g.: With the windows Defender Plugin for WSL2

**Describe alternatives you've considered**
We have blocked these Commands using Powershell but this doesn't fix the CMD-Side (Using event monitor triggers). Also these Commands are only in the bash history of root if bash is executed with something like this `wsl -u root --exec /bin/bash echo Hello World`

**Additional context**
On an enterprise level this feature could be a real showstopper for rolling out to a lot of users. So for Cooperate deployments in restricted environments we would like to restrict those commands.

The issue names PowerShell, CMD, event monitor triggers, and the Windows Defender Plugin for WSL2, but no repository files or tests. Start by tracing how `wsl -u root --exec` enters WSL from both PowerShell and CMD, then review the existing event-monitor approach. Done should be defined as an agreed mechanism to block and audit these commands.

Written by the indexing model from the issue text.