fixes #25

This not only implements the --safe-only option but, for the purpose, refactors the pull_from_trac method into smaller chunks that get utilized. Patchbot will no longer taint SAGE_ROOT with unsafe file merges and thus no longer unnecessarily rebuilds in the original SAGE_ROOT after an unsafe build in tmp/. The central trick is to get the patched file list before merging via the magic command

    git diff --name-only `git merge-base HEAD FETCH_HEAD`..patchbot/ticket_upstream