Safer shell command invocations

This PR contains the following changes:
- Split commands in tokens using Ruby rather than the shell (to avoid `sh -c "some string I just interpolated"`);
- Keep the process running `Grack::Server` in the same working directory, and only let the subprocesses (system commands) `cd` into another directory;
- Restrict the environment variables passed to Git processes to a minimum: only pass `$PATH`, so that the update hook of gitlab-shell can find `/usr/bin/env ruby`.

/cc @randx @dosire