Additionally we bypass the shell by splitting the args into tokens.
This has the effect of quoting 'locale/*/gitlab.po' which means that git
will only match against the working tree. So as we no longer attempt to
checkout a file that is unknown to git, the git error seen in
https://gitlab.com/gitlab-org/gitlab/-/issues/238208#note_407172042
is resolved.