Improves the situation with #3020 a bit.
Does nothing about other valid shell commands that the current
validation would reject:
- shell builtins like --post-hook 'if [ -x /my/script ]; then /my/script; fi'
- variable assignments like --post-hook 'ENV_VAR=value command'
- comments
- redirections like --post-hook '<infile command'
- I'm sure I'm missing many other exciting possibilities