The ntlmclient dependency can now dynamically load OpenSSL.

dlopen sets up some thread-local state that isn't cleaned up by
`dlclose`.  Additionally, now that we're linking against different
versions of libssh2 and OpenSSL, we're seeing different leak signatures.

Provide an interface around OpenSSL to dynamically load the libraries
and symbols, so that users can distribute a libgit2 library that is not
linked directly against OpenSSL.  This enables users to target multiple
distributions with a single binary.

This mechanism is optional and disabled by default.  Configure cmake
with -DUSE_HTTPS=OpenSSL-Dynamic to use it.

Refactor the OpenSSL stream implementation so that the legacy code is better
abstracted.  This will enable future development.

ci: tag new containers with the latest tag

Update all the container versions to force a rebuild so that they'll get
tagged with latest (due to changes in the CI scripts).

ci: update centos builds

openssl: don't fail when we can't customize allocators

During valgrind runs, we try to swap out the OpenSSL allocators for our
own.  This allows us to avoid some unnecessary warnings about usage.
Unfortunately, many builds of OpenSSL do not allow you to swap
allocators; for example FIPS builds and the builds running in CentOS.

Try to swap the allocators, but do not fail when they cannot be
customized.

sha1dc: remove conditional for <sys/types.h>

ci: add centos 7 and centos 8

ci: update nightly to use source path

http: don't require a password

All the other workflows jobs check out into the `source` directory; do this in the documentation build job as well, for consistency across jobs.

Respect the force flag on refspecs in git_remote_fetch

docker: remove the entrypoint

amiga: use ';' as path list separator on AmigaOS

Omitting an entrypoint.sh to configure the container and instead
depending on docker primitives allows us to be more portable.  (If a
distribution uses a different mechanism for adding users, we need not
have multiple entrypoint.sh files or invariants within it; instead we
can configure that in the dockerfile itself along with all the other
distribution specific components.)

Like on Windows ':' is used for volume names in absolute paths.

Attempt authentication when a username is presented but a password is
not; this can happen in particular when users are doing token
authentication and specifying the token in the URL itself.  For example,
`https://token@host/` is a valid URI and should be treated as a username
of `token` with an empty password.