fix(hg): Command injection vulnerability in URLs via alias

> create_repo(
>    url="--config=alias.clone=!touch ./HELLO", vcs="hg", repo_dir="./"
> )

Credit: Alessio Della Libera <alessio.dellalibera@snyk.io> via Snyk

Author: tony

libvcs/hg.py

@@ -26,7 +26,9 @@ def __init__(self, url, repo_dir, **kwargs):
     def obtain(self):
         self.ensure_dir()
 
-        self.run(["clone", "--noupdate", "-q", self.url, self.path])
+        # Double hyphens between [OPTION]... -- SOURCE [DEST] prevent command injections
+        # via aliases
+        self.run(["clone", "--noupdate", "-q", "--", self.url, self.path])
         self.run(["update", "-q"])
 
     def get_revision(self):