[dunecontrol] Fix parsing of Git configuration settings file

dunecontrol fails to properly process Git settings where the value contains
spaces. It was supposed to handle quoting the same way the shell does, but
instead arguments were split at each space and quotes kept verbatim in the
split arguments.

The reason is the order in which the shell performs variable substitution and
tokenizing, preventing the line with the Git configuration entry from being
tokenized by the shell.

This patch fixes the problem by first parsing the line into an array, which is
then in turn expanded again with correct per-element quoting.

In addition, make COMMENT helper variables local while we're at it.
[dunecontrol] Skip unnecessary parsing of Git option lines into array

As Carsten correctly pointed out, it's easier to just eval the command directly.
[dunecontrol] Add some rudimentary protection against user errors during git config parsing

The contents of the files containing git settings is evaluated by the shell, which can
be dangerous if such a file contains a line like 'option value; rm -rf /'. While that is
unlikely, it might happen when people try to create a Git alias.

It would be possible to completely protect users from this problem by parsing the line
completely manually (without involving the shell), but on the other hand, being able to
use shell features for determining option values seems like a good thing to have as well.

This patch adds some rudimentary protection that protects against errors like the one shown
above. More advanced users can still wreak havoc by abusing shell substitution
('option $(echo value; rm -rf /)' comes to mind), but that's not something our average user
will do.

The protection works by splitting the input line into an array first; doing so does not
actually execute the line and so prevents anything outside of value substitutions in $()
from being executed.

Also added a comment to explain why we need to go through the extra step with the array.
Merge branch 'master' into FS1288

This fixes the parsing of git config options.
Be aware that you can use shell code in these options!
Thanks to Steffen Müthig for this fix!