use '--' in source vcs calls to protect against malicious input
use '--' in source vcs calls to protect against malicious input

This is a quick and very incomplete addition of '--' to command line calls
to source VCSs like git and hg that could manipulated by malicious
tag/branch names or other vectors.

These were all manually tested by calling the command lines on my own
machine.

f-droid/fdroid-server,fdroidtravis/fdroidserver,f-droid/fdroid-server,fdroidtravis/fdroidserver,f-droid/fdroidserver,fdroidtravis/fdroidserver,f-droid/fdroid-server,f-droid/fdroidserver,f-droid/fdroidserver,f-droid/fdroid-server,f-droid/fdroid-server,fdroidtravis/fdroidserver,f-droid/fdroidserver,f-droid/fdroidserver