Force pushing should require additional confirmation step

Currently when pushing to upstream, if there was a divergence the user can press Enter to perform a force push. I think force pushing in itself is quite risky and should require an additional confirmation step, in case the user press Enter out of a mistake.

Perhaps we could make a drop list that defaults to cancel and require the user to manually select, or make the user type in some word for confirmation. Any thoughts?