Limitations of ownership checking fox for CVE-2022-24765

[Jeremy Maitin-Shepard <jeremy@jeremyms.com>]

The current fix for CVE-2022-24765 prevents unsafe command execution
in some cases but does not address all cases:

- Ownership by the current user should not be taken to mean "trusted":
the user may have retrieved a directory tree from an untrusted source,
including:
  - Another version control system (which won't prevent a .git directory)
  - Unpacking an archive
  - FUSE mounting a remote filesystem

Additionally, the current fix requires additional configuration to
support existing use cases, and does not provide uses a way to safely
execute commands like `git status` or `git log` on untrusted
repositories.

I think a better solution would be for git to support a `--safe`
option that only runs config-specified commands specifically added to
an allowed list, or if the repository itself has been added to
safe.directories.

Ideally git would default to running in `--safe` mode, but if that is
too disruptive at least the option would be available for use in
prompt commands, etc.

(Please CC me in replies as I'm not subscribed to the list.)