fix(security): validate untrusted values before git, fs and logs

[log0u7]

Summary

Closes the four injection/leak vectors of issue #9 with a warn + safe fallback contract (no hard throw): invalid values are logged at WARN and replaced by the safe default, nothing breaks, the degraded state is visible.

Type of change

• fix (bug fix)
• test

Related issue

Fixes #9

How was this tested?

• make test-ci passes (206/206, +7 security tests)
• make test-async passes (16/16)
• Verified manually on Vim 9.1 / Ubuntu 24.04
• New logic covered by a Vader test, written test-first

The injection was proven before the fix (documented in #9): a .gitmodules branch = --upload-pack=/tmp/pwned.sh passed through git pull origin '<branch>' --ff-only executed the script despite shell quoting (git 2.43). After the fix, the hostile value is refused at the read point, warns, and falls back to default branch resolution.

Validator	Applied at
sanitize_branch	.gitmodules branch read (update pull flow), git submodule add -b
validate_module_path	s:remove_module pathspecs (covers remove + gc)
validate_dir_name	dir option, dict + positional forms
sanitize_url / sanitize_cmd	commit messages, REPO_NOT_FOUND errors, traces, sidebar

Checklist

• Commits follow Conventional Commits (type(scope): subject)
• README.md / doc/plugin_manager.txt / CHANGELOG.md updated if behavior changed
• No new network call at startup (opt-in only, behind a g:plugin_manager_* flag defaulting to off)
• Linux only, Vim 8.2 floor respected (no Vim 9+ features, guard v:version < 802 untouched)