Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory

...