GitHub has recently introduced a new set of tools that aims to
ease the process around vulnerability reports and security fixes.
Part of those tools is a new security tab for projects that will
display contents from a new SECURITY.md file.

Move relevant parts from README.md to this new file to make use
of this feature.

repository: fix garbage return value

error was never initialized and a garbage value returned on success.

cmake: disable fallthrough warnings for PCRE

Our PCRE dependency has uncommented fallthroughs in switch statements.
Turn off warnings for those in the PCRE code.

Configuration parsing: validate section headers with quotes

The `parse_section_header_ext` name suggests that it as an extended
function for parsing the section header.  It is not.  Rename it to
`parse_subsection_header` to better reflect its true mission.

When we reach a whitespace after a section name, we assume that what
will follow will be a quoted subsection name.  Pass the current position
of the line being parsed to the subsection parser, so that it can
validate that subsequent characters are additional whitespace or a
single quote.

Previously we would begin parsing after the section name, looking for
the first quotation mark.  This allows invalid characters to embed
themselves between the end of the section name and the first quotation
mark, eg `[section foo "subsection"]`, which is illegal.

When we don't specify a particular column, don't write it in the error
message.  (column "0" is unhelpful.)

Update the configuration parsing error messages to be lower-cased for
consistency with the rest of the library.

Loosen restriction on wildcard "*" refspecs

Use PCRE for our fallback regex engine when regcomp_l is unavailable

Remote URL last-chance resolution

Explicitly enable the `builtin` regex backend and the PCRE backend for
some Linux builds.

Since libssh2 doesn't read host configuration from the config file,
this callback can be used to hand over URL resolving to the client
without touching the SSH implementation itself.

This avoids any misunderstanding with the REGEX keyword in cmake.

Skip UTF8 BOM in ignore files

We've already added `ZLIB_LIBRARIES` to `LIBGIT2_LIBS` so don't also add the `z` library

We've already added `ZLIB_LIBRARIES` to `LIBGIT2_LIBS` so don't also add the `z` library (libgit2/#5079).

Define SYMBOLIC_LINK_FLAG_DIRECTORY if required

Ensure that we can read and parse an ignore file with a UTF8 BOM.

Use PCRE2 and its POSIX compatibility layer if requested by the user.
Although PCRE2 is adequate for our needs, the PCRE2 POSIX layer as
installed on Debian and Ubuntu systems is broken, so we do not opt-in to
it by default to avoid breaking users on those platforms.

Attempt to locate a system-installed version of PCRE and use its POSIX
compatibility layer, if possible.

Users can now select which regex implementation they want to use: one of
the system `regcomp_l`, the system PCRE, the builtin PCRE or the
system's `regcomp`.

By default the system `regcomp_l` will be used if it exists, otherwise
the system PCRE will be used.  If neither of those exist, then the
builtin PCRE implementation will be used.

The system's `regcomp` is not used by default due to problems with
locales.

Move some win32 type definitions to a standalone file so that they can
be included before other header files try to use the definitions.

PCRE includes compatibility functions that may go unused.  Don't warn.

The '[[:digit:]]' and '[[:alpha:]]' classes require double brackets, not
single.

The regex functions return nonzero (not necessarily negative values) on
failure.

In order to avoid us being unable to match characters which are part of
the normal US alphabet in certain weird languages, add two tests to
catch this behavior.

In order to make it easier adding more locale-related tests, add a
generalized framework handling initial setup of languages as well as the
cleanup of them afterwards.

While we already have a test for `p_regexec` with `LC_CTYPE` being
modified, `regexec` also alters behavior as soon as `LC_COLLATE` is
being modified. Most importantly, `LC_COLLATE` changes the way how
ranges are interpreted to just not handling them at all. Thus, ensure
that either we use `regcomp_l` to avoid this, or that we've fallen back
to our builtin regex functionality which also behaves properly.

While the test asserts that the error value indcates a non-value, it is
actually never getting assigned to. Fix this.

When searching for a configuration key for the diff driver, we construct
the config key by modifying a buffer and then passing it to
`git_config_get_multivar_foreach`. We do not check though whether the
modification of the buffer actually succeded, so we could in theory end
up passing the OOM buffer to the config function.

Fix that by checking return codes. While at it, switch to use
`git_buf_PUTS` to avoid repetition of the appended string to calculate
its length.