<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY

The Git module encourages use of `StrictHostKeyChecking=no` with SSH, which makes the connection vulnerable to a MITM attack.

##### ISSUE TYPE

OpenSSH 7.5+ (2017-03-20) added a safer option which automatically accepts the key on first use but will not allow a MITM on subsequent connections: `StrictHostKeyChecking=accept-new` 

https://man.openbsd.org/ssh_config#StrictHostKeyChecking

It would be great if Ansible encouraged use of that mode by default in the documentation and to implement features such as the Git module's [`accept_hostkey`](https://github.com/ansible/ansible/blob/323d2adfcce9a53e906c2c4a40f6ac5fb32a0e68/lib/ansible/modules/git.py#L1103-L1108) feature.

##### ANSIBLE VERSION

```paste below
N/A
```

##### COMPONENT NAME
* `/modules/source_control/git.py`


''' updates repo from remote sources '''
    set_remote_url(git_path, module, repo, dest, remote)
    commands = []
    fetch_str = 'download remote objects and refs'
    fetch_cmd = [git_path, 'fetch']
    refspecs = []
    if depth:
        
        
        currenthead = get_head_branch(git_path, module, dest, remote)
        if refspec:
            refspecs.append(refspec)
        elif version == 'HEAD':
            refspecs.append(currenthead)
        elif is_remote_branch(git_path, module, dest, repo, version):
            if currenthead != version:
                
                
                
                refspecs.append('+refs/heads/%s:refs/heads/%s' % (version, version))
            refspecs.append('+refs/heads/%s:refs/remotes/%s/%s' % (version, remote, version))
        elif is_remote_tag(git_path, module, dest, repo, version):
            refspecs.append('+refs/tags/' + version + ':refs/tags/' + version)