Fix arbitrary execution of code by untrusted user input.

SSH_ORIGINAL_COMMAND was used in an eval() without check: in a normal
git push this is not a problem but under the hood this command is only
an ssh command so malicious user could do something like the following

  $ ssh vagrant -C 'bar "foo;rm -vfr /tmp/"'
  /usr/local/bin/gitreceive: eval: line 45: unexpected EOF while looking for matching `"'
  /usr/local/bin/gitreceive: eval: line 46: syntax error: unexpected end of file
  /usr/local/bin/gitreceive: line 54: /home/git//hooks/pre-receive: No such file or directory
  chmod: cannot access `/home/git//hooks/pre-receive': No such file or directory
  fatal: unrecognized command 'bar foo'
  rm: cannot remove `/tmp': Permission denied
Merge pull request #16 from gipi/security-fix

Fix arbitrary execution of code by untrusted user input.
Fix issue with single quotes surrounding repo name
Only replace escaped single quotes
Merge pull request #18 from philippbosch/master

Fix issue with single quotes surrounding repo name
Merge remote-tracking branch 'upstream/master'