Properly escape and quote git tag names before passing it as shell parameter

[netomi]

This PR ensures that tag names are properly escaped and quoted before using it as parameter for a shell command.

Malicious actors could forge a tag name for a shell injection attack thus we need to be very careful when passing a user controlled argument like the tag to a shell.