security: stop git parsing a revision as an option (#1125)

Git revisions reach git as operands. Without protection a leading-dash
revision is parsed as an OPTION, which is a real capability rather than a
theoretical one:

  git show --output=<path> <rev>        writes git's output to <path>
  git fetch --upload-pack=<program>     makes git execute <program>

Verified against git 2.49: a revision of "--output=/tmp/x:y" wrote 38 KB of
git output to a caller-chosen path, an arbitrary file overwrite running as
the invoking user. Overwriting a shell profile or a git hook turns that into
code execution.

Reachability: the CLI's own flag parser rejects a leading-dash positional,
so plain "oasdiff diff --output=... rev" is not the path. It is reachable
after the "--" separator, and — more importantly — through the library API,
which any embedding program can call with a revision from an untrusted
source, and through wrappers that pass a revision through from input or
configuration.

Two layers, deliberately:

  - Every git invocation now passes --end-of-options, so git treats what
    follows as an operand.
  - checkRef rejects a revision starting with "-" before git is invoked.
    This does not depend on the git version (--end-of-options landed in
    2.24) and produces a clear error rather than a confusing git one.

No legitimate revision starts with "-", so nothing valid is refused; tests
cover both directions.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>