stash apply: default to at least GIT_CHECKOUT_SAFE

include/git2/stash.h

@@ -96,7 +96,9 @@ typedef enum {
  * @param repo The owning repository.
  * @param index The position within the stash list. 0 points to the
  *              most recent stashed state.
- * @param checkout_options Options to control how files are checked out
+ * @param checkout_options Options to control how files are checked out.
+ *                         A minimum strategy of `GIT_CHECKOUT_SAFE` is
+ *                         implied.
  * @param flags Flags to control the applying process. (see GIT_APPLY_* above)
  *
  * @return 0 on success, GIT_ENOTFOUND if there's no stashed state for the

src/stash.c

@@ -681,11 +681,12 @@ static void normalize_checkout_options(
 		memcpy(checkout_opts, given_checkout_opts, sizeof(git_checkout_options));
 	} else {
 		git_checkout_options default_checkout_opts = GIT_CHECKOUT_OPTIONS_INIT;
-		default_checkout_opts.checkout_strategy =  GIT_CHECKOUT_SAFE;
-
 		memcpy(checkout_opts, &default_checkout_opts, sizeof(git_checkout_options));
 	}
 
+	if ((checkout_opts->checkout_strategy & (GIT_CHECKOUT_SAFE | GIT_CHECKOUT_FORCE)) == 0)
+		checkout_opts->checkout_strategy = GIT_CHECKOUT_SAFE;
+
 	if (!checkout_opts->our_label)
 		checkout_opts->our_label = "Updated upstream";