fix(api,sync): Delimit positional arguments in git clone mirror invocations

[euxaristia]

Description

In crates/gitlawb-node/src/api/repos.rs (fork_repo) and crates/gitlawb-node/src/sync.rs (clone_repo), git clone --mirror passes positional arguments without preceding -- delimiters.

Proposed Fix

Add -- before positional path/URL arguments in git clone --mirror invocations across repos.rs and sync.rs.

[beardthelion]

Downgraded to sev:low and kind:bug. The fix in #376 is right and I have approved it, so this is about
the severity label rather than the change.

I could not reach the execution described here, for two independent reasons.

Peer origins are composed as http(s)://... before they reach the clone, and every production write
to peers.http_url funnels through is_public_http_url. I ran eleven dash-leading forms through
that gate, including leading space, tab, newline and NUL variants, and it rejects all of them, with
passing controls so the result is not vacuous. remote_url therefore cannot begin with -.

Setting that gate aside, the argv shape does not permit it either. Consuming the injected string as
an option leaves the destination as the only positional, and process_batch calls clone_repo only
when that path does not yet exist. Git then fails at fatal: repository '<dest>' does not exist
before it opens any transport. fork_repo is the same story, with both arguments built as
repos_dir joins.

To be clear about what is real: --upload-pack does execute, through a shell, when the remaining
positional is an actual repository. I confirmed that separately. It just is not a shape these call
sites can produce. That is why this is low rather than closed as invalid, and why the delimiter is
still worth having.