Switch to using go-git for Go operations

[rnorth]

Break the dependency on execing the git command, and use https://github.com/go-git/go-git instead.

[lanwen]

Just as a wish which is often ignored (or got forgotten) - commit signature. Git binary picks it up currently automatically, however with go-git additional implementation would be required to handle it during commits.

[sledigabel]

excellent remark @lanwen -- something to keep in mind.

[kurtmckee]

Yep, strongly agree with @lanwen here. I sign my commits and tags and have verified signatures enabled on GitHub.

I advocate to just use git as-is so I can anticipate that my settings are inherited, and that a bug in an alternative implementation doesn't introduce repo corruptions that git fsck will complain about. For example, the Flask repo (with 64k stars on GitHub) already contains corruptions that have side effects when git's fsck is enabled:

# The clone below will exit with a fatal error due to zero-padded file modes.
git clone https://github.com/pallets/flask --config fetch.fsckobjects=true

It's possible for git clients to introduce repo corruptions. I recommend continuing to use vanilla git.