This avoids security shenanigans that can come if your `git-commit-id`
may come from potentially untrusted source (e.g. an API), an attacker
could trick you to run shell commands like:
./manage.py lintmigrations --git-commit-id '; rm -rf dangerous'
or a malicious project may set a config like:
[tool.django_migration_linter]
git_commit_id = "; rm -rf dangerous"
