Limitations of ownership checking fox for CVE-2022-24765

The current fix for CVE-2022-24765 prevents unsafe command execution in some cases but does not address all cases:

- Ownership by the current user should not be taken to mean "trusted":
the user may have retrieved a directory tree from an untrusted source,
including:
  - Another version control system (which won't prevent a .git directory)
  - Unpacking an archive
  - FUSE mounting a remote filesystem

Additionally, the current fix requires additional configuration to support existing use cases, and does not provide uses a way to safely execute commands like `git status` or `git log` on untrusted repositories.

I think a better solution would be for git to support a `--safe` option that only runs config-specified commands specifically added to an allowed list, or if the repository itself has been added to safe.directories.

Ideally git would default to running in `--safe` mode, but if that is too disruptive at least the option would be available for use in prompt commands, etc.

(Please CC me in replies as I'm not subscribed to the list.)