If you pass along something like `-oProxyCommand=...` as the hostname, we would pass that along to ssh unbeknownst to us and potentially also the user, if they were asking a tool to recursively clone submodules. This is the same fix as mainline git although they don't separate the username and host for ssh so ours looks like it's checking more.