Avoid use of `child_process.exec`.

The `exec` function spawns a subshell, which is unnecessary here.
In general, one should always use `execFile` instead of `exec`, which
also avoids a possible security issue with quoted arguments (although
that issue is moot here).  Sets the working directory, just to
be safe.

Also fixes a minor race condition: if a second request for `/_version`
comes in while the first one is still waiting for `git` to return,
the second call wouldn't get the `sha` field added.

Change-Id: Icc1eb9be85a288a457973116dc8ded7aca3e97b8
Merge "Avoid use of `child_process.exec`."