(stable) Don't use "--" to separate flags and arguments in "git ls-remote"

Summary: Fixes T12416. See that task for discussion. Slightly older versions of `git` do not appear to support use of `--` to separate flags and arguments.

Test Plan:
  - Ran `bin/repository update PHABX`.
  - In T12416, had a user with Git 2.1.4 confirm that `git ls-remote X` worked while `git ls-remote -- X` failed.
  - Read `git help ls-remote` to look for any kind of suspicious `--destroy-the-world` flags, didn't see any that made me uneasy.

Reviewers: chad, avivey

Reviewed By: avivey

Maniphest Tasks: T12416

Differential Revision: https://secure.phabricator.com/D17508

src/applications/repository/engine/PhabricatorRepositoryPullEngine.php

@@ -392,8 +392,11 @@ final class PhabricatorRepositoryPullEngine
   private function loadGitRemoteRefs(PhabricatorRepository $repository) {
     $remote_envelope = $repository->getRemoteURIEnvelope();
 
+    // NOTE: "git ls-remote" does not support "--" until circa January 2016.
+    // See T12416. None of the flags to "ls-remote" appear dangerous, and
+    // other checks make it difficult to configure a suspicious remote URI.
     list($stdout) = $repository->execxRemoteCommand(
-      'ls-remote -- %P',
+      'ls-remote %P',
       $remote_envelope);
 
     $map = array();