v0.5.0-ev.2

This release fixes three security issues, and all users should
upgrade. First, a configuration file or other per-machine file placed
in a synced repository, including under another letter case or a
file-system alias, or a symbolic link or submodule entry in a fetched
tree, could replace local settings or be followed outside the sync
folder. Such content is now refused before anything is merged, and
local copies never follow links. Second, a repository's local git
configuration could make the tool's own git calls run a program; those
calls now override the settings that can name one, such as hooks,
fsmonitor, pagers, external diff and textconv tools, credential
helpers and ssh commands. Third, the private-only check now confirms
that the repository still belongs to the configured owner, so a
repository transferred to another account is held, at start-up and at
the running daemon's hourly recheck, instead of receiving further
pushes. Behaviour changes: config.json must be readable and writable
only by its owner (mode 0600), git hooks in a sync repository no
longer run, and git:// and plain http:// remotes are refused.