git: add opt-in command tracing

[crazy-max]

Adds an opt-in Git command tracing mode for Git sources so BuildKit can show the effective Git commands it's running during source resolution and checkout. This feature is disabled by default and can be enabled with BUILDKIT_DEBUG_GIT_COMMANDS=1 build-arg (similar to BUILDKIT_CONTEXT_KEEP_GIT_DIR).

Main motivation relates to crazy-max/diun#1544 (comment). While working through Git source behavior differences around remote contexts, shallow fetches, tags, and .git preservation, it became clear that the existing logs show Git output but don't make the executed commands themselves obvious. That makes troubleshooting slower than it should be, especially for remote Git contexts where the user only sees side effects such as fetched refs, detached HEAD messages, or cache hits without seeing the exact git fetch, git checkout, git remote, or git update-ref calls that produced them:

$ docker buildx --builder builder build --build-arg=BUILDKIT_DEBUG_GIT_COMMANDS=1 https://github.com/docker/buildx.git
#0 building with "builder" instance using docker-container driver

#1 [internal] load git source https://github.com/docker/buildx.git
#1 0.420 ref: refs/heads/master HEAD
#1 0.424 c461e702bf2550c98b16d1e231ec855c19a4facc       HEAD
#1 0.880 c461e702bf2550c98b16d1e231ec855c19a4facc       refs/heads/master
#1 0.056 Initialized empty Git repository in /var/lib/buildkit/runc-overlayfs/snapshots/snapshots/1/fs/
#1 0.414 ref: refs/heads/master HEAD
#1 0.418 c461e702bf2550c98b16d1e231ec855c19a4facc       HEAD
#1 3.407 From https://github.com/docker/buildx
#1 3.407  * [new branch]      master     -> master
#1 3.407  * [new branch]      master     -> origin/master
#1 3.411 c461e702bf2550c98b16d1e231ec855c19a4facc
#1 DONE 5.8s

#2 [internal] load git source https://github.com/docker/buildx.git
#2 0.003 + git -c protocol.file.allow=user ls-remote --symref https://github.com/docker/buildx.git HEAD
#2 0.366 ref: refs/heads/master HEAD
#2 0.370 c461e702bf2550c98b16d1e231ec855c19a4facc       HEAD
#2 0.370 + git -c protocol.file.allow=user ls-remote https://github.com/docker/buildx.git master "master^{}"
#2 0.809 c461e702bf2550c98b16d1e231ec855c19a4facc       refs/heads/master
#2 DONE 0.8s

#1 [internal] load git source https://github.com/docker/buildx.git
#1 DONE 5.8s
...

Not sure if we should have a git query param to enable this like we do for keep-git-dir? Maybe debug?