<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY

The Git module encourages use of `StrictHostKeyChecking=no` with SSH, which makes the connection vulnerable to a MITM attack.

##### ISSUE TYPE

OpenSSH 7.5+ (2017-03-20) added a safer option which automatically accepts the key on first use but will not allow a MITM on subsequent connections: `StrictHostKeyChecking=accept-new` 

https://man.openbsd.org/ssh_config#StrictHostKeyChecking

It would be great if Ansible encouraged use of that mode by default in the documentation and to implement features such as the Git module's [`accept_hostkey`](https://github.com/ansible/ansible/blob/323d2adfcce9a53e906c2c4a40f6ac5fb32a0e68/lib/ansible/modules/git.py#L1103-L1108) feature.

##### ANSIBLE VERSION

```paste below
N/A
```

##### COMPONENT NAME
* `/modules/source_control/git.py`


if git_version_used is None:
            module.fail_json(msg='Cannot find git executable at %s' % git_path)
        if git_version_used < LooseVersion('1.7.5'):
            
            needs_separate_git_dir_fallback = True
        else:
            cmd.append('--separate-git-dir=%s' % separate_git_dir)
    cmd.extend([repo, dest])
    module.run_command(cmd, check_rc=True, cwd=dest_dirname)
    if needs_separate_git_dir_fallback:
        relocate_repo(module, result, separate_git_dir, os.path.join(dest, ".git"), dest)
    if bare and remote != 'origin':
        module.run_command([git_path, 'remote', 'add', remote, repo], check_rc=True, cwd=dest)
    if refspec:
        cmd = [git_path, 'fetch']
        if depth:
            cmd.extend(['--depth', str(depth)])
        cmd.extend([remote, refspec])
        module.run_command(cmd, check_rc=True, cwd=dest)
    if verify_commit:
        verify_commit_sign(git_path, module, dest, version, gpg_whitelist)
def has_local_mods(module, git_path, dest, bare):
    if bare:
        return False
    cmd = "%s status --porcelain" % (git_path)
    rc, stdout, stderr = module.run_command(cmd, cwd=dest)
    lines = stdout.splitlines()
    lines = list(filter(lambda c: not re.search('^\\?\\?.*$', c), lines))
    return len(lines) > 0
def reset(git_path, module, dest):