fix: validate checkout positional reference options

<!-- agent -->
Head.checkout checked keyword options but omitted the serialized reference from
its existing unsafe-option validation (GHSA-23mf-xhv8-69c2). Reference names can
originate in a cloned repository, so callers could reach behavior that normally
requires explicit opt-in without supplying any checkout options themselves.

Pass self through the shared option-candidate helper, matching the argument
actually sent to Git. This applies the existing policy to direct and
cloned references, including abbreviated option spellings, while retaining
allow_unsafe_options=True and ordinary checkout semantics. A leading --
separator would instead make the reference a pathspec and break branch
switching.

Add direct-reference regression coverage and a local clone regression
using synthetic file content; the latter also verifies explicit opt-in.
Both regression tests failed before the guard change. All 30 tests in
test/test_refs.py pass with Python 3.12.14 and Apple Git 2.50.1; git diff
--check passes.

Git behavior reference: local git/git checkout at
1630431f326e15fcde608827b5ff38422528eb59, builtin/checkout.c checkout_main
pathspec_from_file handling, which parses file contents as pathspecs. No Git
source was copied.

Assisted-by: GPT 6.0
Co-authored-by: GPT 6.0 <codex@openai.com>

Author: Byron

doc/source/changes.rst

@@ -8,6 +8,7 @@ Changelog
 Security fixes for
 
 * https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2
 
 If you can, also try and provide feedback on the upcoming v4 branch
 https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.

git/refs/head.py

@@ -283,7 +283,7 @@ def checkout(
         """
         if not allow_unsafe_options:
             Git.check_unsafe_options(
-                options=Git._option_candidates([], kwargs),
+                options=Git._option_candidates([self], kwargs),
                 unsafe_options=Git.unsafe_git_pathspec_from_file_options,
             )
         kwargs["f"] = force

test/test_refs.py

@@ -289,6 +289,25 @@ def test_head_checkout_rejects_pathspec_from_file(self, rw_repo):
                         pathspec_file_nul=True,
                         **{option_name: str(pathspecs)},
                     )
+            for option_name in ("--pathspec-from-file", "--pathspec-from"):
+                branch = Head(rw_repo, f"refs/heads/{option_name}={pathspecs}")
+                with self.assertRaises(UnsafeOptionError):
+                    branch.checkout()
+
+    def test_cloned_head_checkout_rejects_pathspec_from_file(self):
+        with tempfile.TemporaryDirectory() as tdir:
+            base_dir = Path(tdir)
+            with self._repo_with_initial_commit(base_dir) as source:
+                branch = source.create_head("--pathspec-from-file=pathspecs")
+                source.head.reference = branch
+                with Repo.clone_from(source.working_tree_dir, base_dir / "clone") as cloned:
+                    (base_dir / "clone" / "pathspecs").write_text("unmatched-private-content\n", encoding="utf-8")
+                    assert cloned.active_branch.name == branch.name
+                    with self.assertRaises(UnsafeOptionError):
+                        cloned.active_branch.checkout()
+                    with self.assertRaises(GitCommandError) as error:
+                        cloned.active_branch.checkout(allow_unsafe_options=True)
+                    assert "unmatched-private-content" in str(error.exception)
 
     @with_rw_repo("HEAD")
     def test_head_reset_rejects_pathspec_from_file(self, rw_repo):