Since the URL is passed directly to git clone, and the remote-ext helper
will happily execute shell commands, so by default disallow URLs that
contain a "::" unless a new unsafe_protocols kwarg is passed.
(CVE-2022-24439)

Fixes #1515

This commit introduces a potential fix for #1490 and #1483, in which an
`invalid literal for int() with base 10: 'n'` exception was raised
within a diff operation. Within `_handle_diff_line()`, we split the
output of `git diff-tree` on colons (`:` characters), under the
assumption that there are no colons within the paths of the files being
diffed. On POSIX systems this is not a valid assumption. The fix is to
split on `\x00:`, since a null character always precedes the colons we
actually need to split on.

A test already existed for this case (`test_diff_file_with_colon()`),
but it was marked as skipped.

* Split on `\x00:` instead of `:` in `_handle_diff_line()`.
* Unskip `test_diff_file_with_colon()`.