Prevent shell injection when computing commit from sha.

Passing multiple arguments to the `system` command limits shell execution to one and only one command. No matter what input is received it will all be passed to the command specified as the first argument, in this case the `git` command.

The downside is the `system` command returns `true` or `false` depending on its exit status, so we have to capture its output manually.

@steved555 @jwswj @cericksen 

The changes from this morning triggered a Code Climate shell injection warning. Although the changes were just a bugfix and no additional security thread was added, we might as well clean up the existing threat while we're in this area.