v2.0.8 — submodules, and a hardened git and backup layer

Added

• Submodules: list (path, address, branch, commit, state), update one or all,
  add, change address and branch, and remove, in the dashboard and with
  bin/php/submodule.php. Adding, changing and removing stage the change for a commit
  and need the new git_manager/submodules policy function.

Fixed

• Branch names and commit hashes reach git only when valid, and quoted: a branch name
  or a hash from the address is never read by the shell or as a git option.
• Backups are readable by their owner only (they were world-readable), and the
  database password goes to mysqldump in an owner-only option file instead of the
  command line; database name and paths are quoted.
• The backup folder refuses web requests itself (.htaccess); downloads are never
  cached (no-store); var backups leave out session files.
• The AGPL dump removes every table with secrets or personal data (password reset and
  activation keys, OAuth clients and tokens, form submissions, orders, payments,
  newsletter subscribers) and keeps remote_ids, so it imports again.
• The backup page escapes descriptions, timestamps, file names and messages.
• Git output shown on the page masks credentials in addresses.

Updated

• backup-create.php takes the passphrase from --passphrase-file,
  GIT_MANAGER_BACKUP_PASSPHRASE or a hidden prompt; -p still works, with a warning.

Upgrading: backups made before 2.0.8 keep their old permissions; make them
owner-only with chmod -R go-rwx on the BackupPath folder.