The Bleep 4.0.1 — security release

Security release

If you are on 4.0.0, upgrade. 4.0.0 has been removed from PyPI.

A branch name, a filename or a git alias could run a command. Seven rules read a
name out of the failed command's own output and spliced it into the suggestion
without shell-quoting it — and a suggestion is evaluated by your shell once you
accept it. Only whitespace, control characters and ~^:?*[\ are illegal in a
git ref name, so ;, $(), a backtick, &, | and # were all available to
whoever named the branch. You do not choose the branch when you are reviewing
somebody else's work or have just cloned a repository.

• git_push, git_pull, git_push_different_branch_names — the branch out of git's own hint
• git_merge — a branch name from the remote
• git_help_aliased — an alias out of the repository's .git/config
• fix_file — a filename off disk, which needs no git at all: unpacking an archive is enough
• yarn_alias, rails_migrations_pending — a whole command line repeated out of the tool's output

All of them quote what they read now, and all of them are in
tests/test_injection.py,
which runs every suggestion through a real shell against seven metacharacter
payloads and fails if anything executes.

This also settles a crash of long standing: a branch called
swteam/#486/general_contact_info produced a suggestion that broke zsh's eval
(nvbn/thefuck#782, and #600 and #762 before it). The upstream fix for that was
.replace("'", r"\'"), which only ever covered the apostrophe.

Reported by @robkorv in #2, with a working proof of concept for three of them;
the other four came out of the sweep that followed.

Full detail in CHANGELOG.md.