GHSA-fx3j-rwgx-fr94: GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name

Repo._clone()’s handling of separate_git_dir never disables Git.polish_url()’s environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since separate_git_dir can be derived from an attacker-controlled .gitmodules submodule name, a completely ordinary clone + submodule_update(init=True, recursive=True) on a malicious repository expands an environment variable of the attacker’s choosing and exposes its value both as a persistent on-disk directory name and, whenever DEBUG-level logging is enabled (a common CI/verbose-logging configuration), in a Popen(...) log line that is not redacted the way credential-bearing arguments are.