CVE-2026-11332: Add the '--' end-of-options separator before the user-controlled src and name positional arguments of the 'git clone' argv built by scm_archive_resource(), so a role requirement whose src or name begins with '-' can no longer be parsed by git as an option.