feat: allow oauth* config values to be shell commands

[andrew-grechkin]

Any credential.<url>.oauth* value wrapped in backticks is now executed via the user's default shell ($SHELL on Unix, %COMSPEC% on Windows, with /bin/sh and cmd.exe as fallbacks) and its trimmed STDOUT is used in place of the literal value.

Motivation: OAuth client secrets sitting plaintext in ~/.gitconfig are awkward to protect. This lets users source them from a password manager or keychain via a pipeline, e.g.

oauthClientSecret = `pass show secret/some-site.com/oauth-client-secret | head -1`

Only the oauth* keys this helper reads are evaluated; other git config values are untouched. Pipes and other shell features are supported since execution goes through the shell rather than a direct exec.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[kerhac]

I am not associated with this project, this is just some random guys opinion.

Using backticks inside the gitconfig seems somewhat unconventional and my cause issues when using the git command line to set configuration options. In this case I would personally prefer using an additional configuration option for supplying a command instead of the value. That said it's also disputable if the oauth client secret needs to be encrypted at all, take a look in #73 (comment).