Apply escapeshellarg() to the branch parameter in GitBuild and HgBuild to prevent OS command injection (CWE-78) through the unauthenticated webhook endpoint. Also remove the double-quote wrapper around the branch format-string placeholder in GitBuild so that the single quotes produced by escapeshellarg() are effective at the shell level.

The commitId parameter also originates from the unauthenticated webhook request (the 'commit' query parameter) and is passed unsanitized into git checkout and git log shell commands in postCloneSetup(). Apply escapeshellarg() to all commitId usages to close this additional injection vector.