curl: use the most secure auth method for the proxy

Locking and transactional/atomic updates for config

remote: don't confuse tag auto-follow rules with refspec matching

This makes the API for commiting or discarding changes the same as for
references.

This lock/unlock pair allows for the cller to lock a configuration file
to avoid concurrent operations.

It also allows for a transactional approach to updating a configuration
file. If multiple updates must be made atomically, they can be done
while the config is locked.

When a configuration file is locked, any updates made to it will be done
to the in-memory copy of the file. This allows for multiple updates to
happen while we hold the lock, preventing races during complex
config-file manipulation.

Instead of writing into the filebuf directly, make the functions to
write the modified config file write into a buffer which can then be
dumped into the lockfile for committing.

This allows us to re-use the same code for modifying a locked
configuration, as we can simply skip the last step of dumping the data
to disk.

Forcing libssh2 lib location in CMake

When we're looking to update a tag, we can't stop if the tag auto-follow
rules don't say to update it. The tag might still match the refspec we
were given.

While we download the remote's remote-tracking branches, we don't
download the tag. This points to the tag auto-follow rules interfering
with the refspec.

When curl uses a proxy, it will only use Basic unless we prompt it to
try to use the most secure on it has available.

This is something which git did recently, and it seems like a good idea.

OS X may have libssh2 in diff locations, so CHECK_LIBRARY_EXISTS may check the wrong lib; forcing it to use a found directory.

Fix duplicate basenames to support older VS on master

With Visual Studio versions 2008 and older they ignore the full path to files and only check
the basename of the file to find a collision. Additionally, having duplicate basenames can break
other build tools like GYP.

This fixes https://github.com/libgit2/libgit2/issues/3356

Error handling: use buffers, improved OOM handling

When an error state is an OOM, make sure that we treat is specially
and do not try to free it.

Allow restoring a previously captured oom error, by
detecting when the captured message pointer points to the
static oom error message.  This means there is no need
to strdup the message in giterr_detach.

Error messages that are detached are assumed to be dynamically
allocated.  Passing a pointer to the static oom error message
can cause an attempt to free the static buffer later.  This change
checks if the oom error message is about to be detached and detaches
a copy instead.

 filebuf: remove lockfile upon rename errors

index: stage an unregistered submodule as well

Handle ssh:// and git:// urls containing a '~' character.

For such a path '/~/...' the leading '/' is stripped so the server will
get a path starting with '~' and correctly handle it.

We previously added logic to `_add_bypath()` to update a submodule. Go
further and stage the submodule even if it's not registered to behave
like git.

When we pass the path of a repository to `_bypath()`, we should behave
like git and stage it as a `_COMMIT` regardless of whether it is
registered a a submodule.

Resolve documentation warnings

Remove extra semicolon outside of a function

Without this change, compiling with gcc and pedantic generates warning:
ISO C does not allow extra ‘;’ outside of a function.

iterator: skip over errors in diriter init

case-insensitive check for WWW-Authenticate header

Fixes issue #3338

Instead of allocating a brand new buffer for each error string we want
to store, we can use a per-thread buffer to store the error string and
re-use the underlying storage. We already use the buffer to format the
string, so this mostly makes that more direct.