Merge checkout strategy

@jamill rightly informed me that I was an idiot when it came to checkout strategy.  This fixes two issues in merge:

1. The default checkout strategy should *not* be `SAFE_CREATE`, it should be `SAFE`.  With `SAFE_CREATE`, you could have an unstaged delete in your working directory, perform a merge (where the file was untouched by the merge) and we would check the file back out for you!  Using `SAFE` fixes that up, and we behave like git core.
2. We did not allow an checkout strategy of `NONE`.  I think that it is crazy that anybody would ever want this, because we would blow away their index with the merge result and then not touch the working directory.  But it's certainly theoretically possible, and moreso, I cringe when I was asked to better document the current behavior because I couldn't justify overwriting their perfectly legitimate (but bizarre) choice with my also perfectly legitimate choice.  A `NULL` checkout options struct remains unchanged.

Note that there may be fallout for a binding (@arthurschreiber) that has hooked up merge and *is* providing a checkout options struct with a merge strategy of 0.