sec: added --end-of-options to prevent unintended options

[caarlos0]

this prevents user-provided args being handles as git options.

[caarlos0]

this was failing for me in main as well

[Copilot]

Pull Request Overview

This PR adds security hardening to Git command construction by adding the --end-of-options flag to prevent user-provided arguments from being interpreted as Git options.

• Adds --end-of-options flag to Git commands that accept user-controlled input
• Updates test to use a safer reference name without hyphens
• Ensures proper argument separation between Git options and user data

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
repo_tag.go	Adds --end-of-options to tag creation and deletion commands
repo_remote.go	Adds --end-of-options to various remote operations (add, remove, get-url, set-url)
repo_reference_test.go	Changes test reference name from "TEST-REF" to "TESTREF"
repo_reference.go	Adds --end-of-options to show-ref, symbolic-ref, and branch deletion commands
repo_pull.go	Adds --end-of-options to merge-base command
repo_grep.go	Adds --end-of-options to grep command
repo_diff.go	Adds --end-of-options to various diff and format-patch commands
repo_commit.go	Adds --end-of-options to log, diff, and rev-list commands
repo.go	Adds --end-of-options to init, clone, push, reset, move, and show commands

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}