Command injection in counsel-git-checkout-action

`counsel-git-checkout-action` happily executes command substitutes in
git branch names -- e.g.

```sh
$ git clone https://github.com/dyntopia/counsel-branch
$ emacs counsel-branch/test
```

```
M-x counsel-git-checkout RET RET
/bin/bash: abcd: command not found
error: pathspec 'remotes/origin/' did not match any file(s) known to git.
```