revset: use decorator to mark a predicate as safe Using decorator can localize changes for adding (or removing) a "safe" revset predicate function in source code. To avoid accidentaly treating unsuitable predicates as safe, this patch uses False as default value of "safe" argument. This forces safe predicates to be decorated with explicit 'safe=True'.