Submodule and http fixes

When the server rejects an authentication request, ask the caller for
the credentials again, instead of giving up on the first try.

We allow looking up a submodule by path, but we lost the path
normalisation during the recent changes. Bring it back.

Remove some of the logic that was left-over from the time we had a cache
of submodules, plugging a leak of the submodule object in certain cases.

pkg-config: Sort the different sections

Because of the fact that pkg-config is pants-on-head retarded and that
the Linux linker *requires* a static library to come before all its
dynamic dependencies in the link path, calling `pkg-config --libs
--static` was generating the wrong flags for linking.

Before this patch:

	-Wl,-Bsymbolic-functions -Wl,-z,relro -L/usr/local/lib -lcurl -lssh2
	-lrt -lgit2 -lssl -lcrypto -ldl -lz

After this patch:

	-Wl,-Bsymbolic-functions -Wl,-z,relro -L/usr/local/lib -lgit2 -lcurl
	-lssh2 -lrt -lssl -lcrypto -ldl -lz

By setting the "Libs" line before all other rules, we make sure that
`-lgit2` is the first library in the link path and that it gets its
symbols resolved with the libraries coming after it.

This fix (ab)uses an implementation detail in `pkg-config` (namely, that
flags are output as they are found on the file), but this detail seems
to be stable between releases and always gives a stable output.

CMake: treat the ld flags as a list

These are treated as a list by CMake itself, which means that treating
them as a simple string can put semicolons in our ld command-line if we
have libraries which are not installed on the standard locations.

Treat the variable as a CMake list and replace it with the space-delimited
list just before writing it out to our pc file.

Plug a bunch of leaks

stash: test we apply using reflog-like indices

Fast builds?

We're installing dependencies via the APT addon now.

Fixes

Stash apply: stage new files even when not updating the index

Desenfuckenate prefix lookups

This reverts commit 969d4b70.

This was a fluke from Coverity. The length to all the APIs in the
library is supposed to be passed in as nibbles, not bytes. Passing it as
bytes would prevent us from parsing uneven-sized SHA1 strings.

Also, the rest of the library was still using nibbles (including
revparse and the odb_prefix APIs), so this change was seriously breaking
things in unexpected ways. ^^

pc: Put libcurl and libssh2 in Libs.private

Pass on to whoever wants to link to libgit2 statically the flags that we
would have used for these libraries.

Putting them in Requires.private as we do now makes pkg-config put their
dependencies in the linker arguments as well, which is not what we want.

Dont update index unnecessarily

When diffing the index with the workdir and GIT_DIFF_UPDATE_INDEX has been passed,
the previous implementation was always writing the index to disk even if it wasn't
modified.

Test that workdir diffs, when presented with UPDATE_INDEX, only
write the index when they actually make a change.

Rename FALLBACK to UNSPECIFIED

List `libcurl` in the generated `libgit2.pc`

Files that were new (staged additions) in the stash tree should
be staged when unstashing, even when not applying the index.

Provide `git_iterator_walk` to walk each iterator in lockstep,
returning each iterator's idea of the contents of the next path.