Racy fixes for writing new indexes

Protect windows SYSDIR when running tests

Don't put the configuration in a subdir of the sandbox named
`config`, lest some tests decide to create their own directory
called `config`.  Prefix with some underscores for uniqueness.

Query the `GIT_CONFIG_LEVEL_PROGRAMDATA` location when setting it up
for tests, in case the test runner has sandboxed it.

Allow users to set the `git_libgit2_opts` search path for the
`GIT_CONFIG_LEVEL_PROGRAMDATA`.  Convert `GIT_CONFIG_LEVEL_PROGRAMDATA`
to `GIT_SYSDIR_PROGRAMDATA` for setting the configuration.

Ensure that `git_index_read_index` clears the uptodate bit on
files that it modifies.

Further, do not propagate the cache from an on-disk index into
another on-disk index.  Although this should not be done, as
`git_index_read_index` is used to bring an in-memory index into
another index (that may or may not be on-disk), ensure that we do
not accidentally bring in these bits when misused.

Ensure that `git_index_read_tree` clears the uptodate bit on files
that it modifies.

The uptodate bit should have a lifecycle of a single read->write
on the index.  Once the index is written, the files within it should
be scanned for racy timestamps against the new index timestamp.

Test that entries are only smudged when we write the index: the
entry smudging is to prevent us from updating an index in a way
that it would be impossible to tell that an item was racy.
Consider when we load an index:  any entries that have the same
(or newer) timestamp than the index itself are considered racy,
and are subject to further scrutiny.

If we *save* that index with the same entries that we loaded,
then the index would now have a newer timestamp than the entries,
and they would no longer be given that additional scrutiny, failing
our racy detection!  So test that we smudge those entries only on
writing the new index, but that we can detect them (in diff) without
having to write.

When there's no matching index entry (for whatever reason), don't
try to dereference the null return value to get at the id.

Otherwise when we break something in the index API, the checkout
test crashes for confusing reasons and causes us to step through
it in a debugger thinking that we had broken much more than we
actually did.

Keep track of entries that we believe are up-to-date, because we
added the index entries since the index was loaded.  This prevents
us from unnecessarily examining files that we wrote during the
cleanup of racy entries (when we smudge racily clean files that have
a timestamp newer than or equal to the index's timestamp when we
read it).  Without keeping track of this, we would examine every
file that we just checked out for raciness, since all their timestamps
would be newer than the index's timestamp.

When examining paths that are racily clean, do a single index->workdir
diff over the entirety of the racily clean files, instead of a diff
per file.

pool: Never return unaligned buffers

git_index_entry__init_from_stat: set nsec fields in entry stats

Improve error messages when dirs prevent ref/reflog creation

Support setting custom user-agent

We also keep the "git/1.0" prefix in order to maintain compatibility
with hosters.

We still prefix it with "git/1.0" since that's required in many
situations, but we replace the area which mentions libgit2.

Failing test for case sensitive conflicts in the index

When a non-empty directory exists and prevents the creation of a
reflog, provide a more informative error message.

When a (non-empty) directory exists at the reference target
location, complain with a more actionable error message.

When we insert a conflict in a case-insensitive index, accept the
new entry's path as the correct case instead of leaving the path we
already had.

This puts `git_index_conflict_add()` on the same level as
`git_index_add()` in this respect.

When we're at offset 'i', we're dealing with the 'i+1' stage, since
conflicts start at 1.

Diff: Honor `core.symlinks=false` and fake symlinks

Handle submodules with paths in `git_submodule_update`

Reload the HEAD and index data for a submodule after reading the
configuration.  The configuration may specify a `path`, so we must
update HEAD and index data with that path in mind.

Test that `git_submodule_update` can handle a submodule that is
freshly cloned and has a path differing from its name.

stream: allow registering a user-provided TLS constructor

whitespace.  Collapse spaces around newlines for the summary.

When creating a filebuf, detect a directory that exists in our
target file location.  This prevents a failure later, when we try
to move the lock file to the destination.

Test that on platforms without `core.symlinks`, we preserve symlinks
in `git_index_add_bypath`.  (Users should correct the actual index
entry's mode to change a link to a regular file.)

On platforms that lack `core.symlinks`, we should not go looking for
symbolic links and `p_readlink` their target.  Instead, we should
examine the file's contents.

When `core.symlinks = false`, we write the symlinks content (target)
to a regular file.  We should ensure that when we later see that
regular file, we treat it specially - and that changing that regular
file would actually change the symlink target.  (For compatibility
with Git for Windows).