Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`

Impactdulwich.porcelain.formatpatchoutdir=... derives each patch filename from the commit's subject line. Prior to this fix, getsummary only replaced spaces with dashes - path separators /, \, parent-directory components .., and other filename-hostile characters e.g. : were preserved verbatim and...

Multiple Web servers information leak

It's possible to access script sources and/or bypass access restrictions by using Windows 8.3 filenames and space characters...