[GHSA] GHSA-hh9p-6wh2-4mfc (medium) — GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

GHSA-hh9p-6wh2-4mfc Severity: medium CVE: None

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

## Summary

`IndexFile.remove()` and `Head.checkout()` forward `**kwargs` into `git rm` and `git checkout` with no guard. Passing `--pathspec-from-file=<file>` **together with `--pathspec-file-nul`** makes Git treat the whole file as a single NUL-delimi