Escape strings that may comes from remote sources

Use printf "%q" to escape branch names.
Handle cases where git has no upstream with default locals