Prevent shell injection when computing commit from sha.

Passing multiple arguments to the `system` command limits shell
execution to one and only one command. No matter what input is
received it will all be passed to the command specified as the first
argument, in this case the `git` command.

The downside is the `system` command returns `true` or `false`
depending on its exit status, so we have to capture its output
manually.
Better names
Merge pull request #26 from zendesk/josh/prevent_shell_injection2

Prevent shell injection when computing commit from sha.