GHSA-CWVM-V4W8-Q58C GitPython blind local file inclusion

Summary In order to resolve some git references, GitPython reads files from the .git directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the .git directory. This allows an attacker to make GitPython read any fi...