Some of the globs might expand into files that start with a dash, so
pass -- everywhere to keep problems from showing up.  Some call sites
don't actually need this, but better to be consistent.