<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY

The Git module encourages use of `StrictHostKeyChecking=no` with SSH, which makes the connection vulnerable to a MITM attack.

##### ISSUE TYPE

OpenSSH 7.5+ (2017-03-20) added a safer option which automatically accepts the key on first use but will not allow a MITM on subsequent connections: `StrictHostKeyChecking=accept-new` 

https://man.openbsd.org/ssh_config#StrictHostKeyChecking

It would be great if Ansible encouraged use of that mode by default in the documentation and to implement features such as the Git module's [`accept_hostkey`](https://github.com/ansible/ansible/blob/323d2adfcce9a53e906c2c4a40f6ac5fb32a0e68/lib/ansible/modules/git.py#L1103-L1108) feature.

##### ANSIBLE VERSION

```paste below
N/A
```

##### COMPONENT NAME
* `/modules/source_control/git.py`


if umask is not None:
        if not isinstance(umask, string_types):
            module.fail_json(msg="umask must be defined as a quoted octal integer")
        try:
            umask = int(umask, 8)
        except Exception:
            module.fail_json(msg="umask must be an octal integer",
                             details=to_text(sys.exc_info()[1]))
        os.umask(umask)
    
    
    if os.path.expanduser(repo).startswith('/'):
        repo = 'file://' + os.path.expanduser(repo)
    
    
    locale = get_best_parsable_locale(module)
    module.run_command_environ_update = dict(LANG=locale, LC_ALL=locale, LC_MESSAGES=locale, LC_CTYPE=locale)
    if separate_git_dir:
        separate_git_dir = os.path.realpath(separate_git_dir)
    gitconfig = None
    if not dest and allow_clone:
        module.fail_json(msg="the destination directory must be specified unless clone=no")
    elif dest:
        dest = os.path.abspath(dest)
        try:
            repo_path = get_repo_path(dest, bare)
            if separate_git_dir and os.path.exists(repo_path) and separate_git_dir != repo_path:
                result['changed'] = True
                if not module.check_mode: