Stash apply: stage new files even when not updating the index

Desenfuckenate prefix lookups

This reverts commit 969d4b70.

This was a fluke from Coverity. The length to all the APIs in the
library is supposed to be passed in as nibbles, not bytes. Passing it as
bytes would prevent us from parsing uneven-sized SHA1 strings.

Also, the rest of the library was still using nibbles (including
revparse and the odb_prefix APIs), so this change was seriously breaking
things in unexpected ways. ^^

pc: Put libcurl and libssh2 in Libs.private

Pass on to whoever wants to link to libgit2 statically the flags that we
would have used for these libraries.

Putting them in Requires.private as we do now makes pkg-config put their
dependencies in the linker arguments as well, which is not what we want.

Dont update index unnecessarily

When diffing the index with the workdir and GIT_DIFF_UPDATE_INDEX has been passed,
the previous implementation was always writing the index to disk even if it wasn't
modified.

Test that workdir diffs, when presented with UPDATE_INDEX, only
write the index when they actually make a change.

Rename FALLBACK to UNSPECIFIED

List `libcurl` in the generated `libgit2.pc`

Files that were new (staged additions) in the stash tree should
be staged when unstashing, even when not applying the index.

Provide `git_iterator_walk` to walk each iterator in lockstep,
returning each iterator's idea of the contents of the next path.

remote: insert refspecs with no rhs in FETCH_HEAD

Don't allow growing borrowed buffers

When a refspec contains no rhs and thus won't cause an explicit update,
we skip all the logic, but that means that we don't update FETCH_HEAD
with it, which is what the implicit rhs is.

Add another bit of logic which puts those remote heads in the list of
updates so we put them into FETCH_HEAD.

Fallback describes the mechanism, while unspecified explains what the
user is thinking.

This explains more closely what happens. While here, set an error
message.

We've been using EINVALIDSPEC for a while to mean this, but that name
is too specific. Introduce this to be more explicit.

We currently recommend using `git_buf_grow` in order to make a buffer
make an owned copy of the memory it points to. This is not behaviour we
should encourage, so remove this recommendation.

The function itself is not changed, as we need to remain compatible, but
it will be changed not to allow usage on borrowed buffers.

When we don't own a buffer (asize=0) we currently allow the usage of
grow to copy the memory into a buffer we do own. This muddles the
meaning of grow, and lets us be a bit cavalier with ownership semantics.

Don't allow this any more. Usage of grow should be restricted to buffers
which we know own their own memory. If unsure, we must not attempt to
modify it.

Remove run-time configuration settings from submodules

Implement a cURL stream

Handle binary DIFFABLEness properly

Stash workdir correctly when added in the index, modified in the workdir

Always set `GIT_DIFF_PATCH_DIFFABLE` for all files, regardless of
binary-ness, so that the binary callback is invoked to either
show the binary contents, or just print the standard "Binary files
differ" message.  We may need to do deeper inspection for binary
files where we have avoided loading the contents into a file map.

Ensure that even when we're forcing a binary diff that we do not
assume that there *is* a diff.  There should be an empty diff for
no change.

If the libcurl stream is available, use that as the underlying stream
instead of the socket stream. This allows us to set a proxy for HTTPS
connections.

We do not want libcurl to perform the TLS negotiation for us, so we
don't need to pass this option.

The TLS streams talk over the curl stream themselves, so we don't need
to ask for it explicitly. Do so in the case of the non-encrypted one so
we can still make use proxies in that case.

When linking against libcurl, use it as the underlying transport instead
of straight sockets. We can't quite just give over the file descriptor,
as curl puts it into non-blocking mode, so we build a custom BIO so
OpenSSL sends the data through our stream, be it the socket or curl
streams.

The information is exposed by curl for some crypto libraries in the form
of name:content strings. We can't do much more than return this
information.

Of the built-in ones, only cURL support it, but there's no reason a
user-provided stream wouldn't support it.

If the stream claims to support this feature, we can let the transport
set the proxy.

We also set HTTPPROXYTUNNEL option so curl can create a tunnel through
the proxy which lets us create our own TLS session (if needed).