midx: Fix an undefined behavior (left-shift signed overflow)

Fix crash when regenerating a patch with unquoted spaces in filename

tests: support flaky stat

The 32-bit ARM QEMU builds are flaky when running `lstat`. Disable those
testing `lstat`'s `st_size` temporarily.

diff: don't stat empty file on arm32 (flaky test)

sha256: support dynamically loaded openssl

There was a missing check to ensure that the `off64_t` (which is a
signed value) didn't overflow when parsing it from the midx file. This
shouldn't have huge repercusions since the parsed value is immediately
validated afterwards, but then again, there is no such thing as "benign"
undefined behavior.

This change makes all the bitwise arithmetic happen with unsigned types
and is only casted to `off64_t` until the very end.

Thanks to Taotao Gu for finding and reporting this!

fetch: support OID refspec without dst

Our CI test infrastructure virtualizes arm32 in docker, which is a
sometimes imperfect situation. In `diff::workdir::can_diff_empty_file`,
avoid the stat to ensure that the file is zero bytes; there is an odd
issue running in qemu when emulating arm32 that we should skip.

SHA256: add a SHA256 implementation backend

gcc (mingw) warns when you cast the result of `GetProcAddress`; cast the
results to `void *` before casting them to the actual result.

When GIT_SHA1_WIN32 or GIT_SHA256_WIN32 is used, ensure that we test
both CryptoNG ("cng") and CryptoAPI.

Adding SHA256 support prompted an overdue refactoring of some of the
unnecessary complexity around the CNG/CryptoAPI abstraction.

Add support for a SHA256 hash algorithm, and add the "builtin" SHA256
hash engine (from RFC 6234).

The more generic GIT_ERROR_SHA allows for SHA256 errors as well as SHA1.

Eliminate the `sha1` folder, move it down into `hash` so that future
impelmentations can share common code.

Remove the "generic" implementation; it should never be used; it only
existed for a no-dependencies configuration, and our bundled sha1dc
satisfies that requirement _and_ is correct.

Benchmarking suite

Support the ability to create a refspec that is a single object ID
without a destination.

clone: update bitbucket tests

Fix a string concatenation bug when validating extensions

As builtin extensions are evaluated in the latter half of `check_valid_extension`, a string `cfg` is concatenated with the static string 'extension.' and the value from `builtin_extension`, before being compared with the configured value. This string is not being cleared while iterating through the names of the extensions. Because there is currently only one extension ('noop'), the bug was never noticible.

This patch corrects the behavior by clearing the string on each iteration, as is done in the first block.

This fixes a crash in test cases
test_diff_parse__new_file_with_space_and_regenerate_patch
and
test_diff_parse__delete_file_with_space_and_regenerate_patch

This currently crashes, proposed fix in subsequent commit.

Some minor fixes for issues discovered by coverity

cmake: export libraries needed to compile against libgit2

Add a benchmark test suite that wraps hyperfine and is suitable for
producing data about test runs of a CLI or A/B testing CLIs.

Allow for options in the `cmake --build` phase, so that callers can
specify (eg) the config type.

Rename our build setup scripts to include the `build` name so that we
can add additional CI setup scripts with no ambiguity.

If users are using us as a direct dependency (via `add_subdirectory`)
then they may want to know the libraries to link to; tell them.

Mistakenly `&&` when we should have `||`d.