Security concern - fetch can accidentally allow users of the lib to allow command injection

[kenotron]

git fetch has an extra parameter you could potentially use that executes arbitrary commands: --upload-pack. The issue is here:

workspace-tools/src/git.ts

Line 121 in 24040a5

const results = git(["fetch", remote], { cwd });

and

workspace-tools/src/git.ts

Line 129 in 24040a5

const results = git(["fetch", remote, remoteBranch], { cwd });

Fix is to add a -- in the arg list like this: fetch -- remote remotebranch. This may not be a big deal, but it has come up as a security issue with other git wrapper libs.