Reject git repository values that are empty, start with '-', or contain
null bytes, and pass '--' before the repository argument in git clone and
git remote add. This prevents git option injection when fetching
git-hosted dependencies from unvalidated lockfile resolutions, matching
pnpm v12.
The INVALID_GIT_REPOSITORY message now lists every rejected form in both
CLIs, and pnpm v12 reports it as ERR_PNPM_INVALID_GIT_REPOSITORY. The v11
INVALID_GIT_COMMIT message redacts credentials and strips control
characters.
Fixes https://github.com/pnpm/tasks/issues/84
Zoltan Kochan
480450091c