git_update(): avoid SSH_AUTH_SOCK if unneeded, add GitHub keys if needed

(I was surprised today by a labtarna deploy that asked me about the
GitHub host key: turns out previously it was in
/home/lims/.ssh/known_hosts but not in /root/.ssh/known_hosts.  We can't
rely on git_clone() to add it to /root since we may have existing
deployments that didn't use root for the initial clone.)