[dunecontrol] Add some rudimentary protection against user errors during git config parsing

The contents of the files containing git settings is evaluated by the shell, which can
be dangerous if such a file contains a line like 'option value; rm -rf /'. While that is
unlikely, it might happen when people try to create a Git alias.

It would be possible to completely protect users from this problem by parsing the line
completely manually (without involving the shell), but on the other hand, being able to
use shell features for determining option values seems like a good thing to have as well.

This patch adds some rudimentary protection that protects against errors like the one shown
above. More advanced users can still wreak havoc by abusing shell substitution
('option $(echo value; rm -rf /)' comes to mind), but that's not something our average user
will do.

The protection works by splitting the input line into an array first; doing so does not
actually execute the line and so prevents anything outside of value substitutions in $()
from being executed.

Also added a comment to explain why we need to go through the extra step with the array.

bin/dunecontrol

@@ -379,7 +379,10 @@ run_default_vcsetup() {
         # Filter out comments
         local COMMENT="$(echo $REPLY | $GREP '^#')"
         if [ ! "x$COMMENT" = "x$REPLY" ]; then
-          eval git config $REPLY
+          # parse line into an array first to catch obvious syntax errors
+          # like 'option value; rm -rf /'
+          eval local GIT_OPTS=($REPLY)
+          git config "${GIT_ARGS[@]}"
         fi
       done
       echo "done"
@@ -393,7 +396,10 @@ run_default_vcsetup() {
           # Filter out comments
           local COMMENT="$(echo $REPLY | $GREP '^#')"
           if [ ! "x$COMMENT" = "x$REPLY" ]; then
-            eval git config $REPLY
+            # parse line into an array first to catch obvious syntax errors
+            # like 'option value; rm -rf /'
+            eval local GIT_OPTS=($REPLY)
+            git config "${GIT_ARGS[@]}"
           fi
         done
         echo "done"