Add a few tests for the SCM module.
    
    In particular, test to see if we can pass a branch name with shell
    characters, and get MBS to inadvertently execute malicious code.
    
    The test shows that doing this in a straightforward way is not possible
    and should guard against any future regressions.
    
    Fixes #329.