Refactor `git_filter_list__load_with_attr_reader` into
`git_filter_list__load_ext`, which takes a `git_filter_options`.

For consistency with the rest of the library, where an opt is an
options *structure*.

Provide a convenience function that creates a buffer that can be provided
to callers but will not be freed via `git_buf_free`, so the buffer
creator maintains the allocation lifecycle of the buffer's contents.

Test pushing a file on-disk into a streaming filter that compresses
it into the ODB, and inflates it back into the working directory.

Let the filters use the checkout data's temporary buffer, instead
of having to allocate new buffers each time.

Use the new streaming filter API during checkout.

Migrate the `git_filter_list_apply_*` functions over to using the
new filter streams.

Add structures and preliminary functions to take a buffer, file or
blob and write the contents in chunks through an arbitrary number
of chained filters, finally writing into a user-provided function
accept the contents.

Remove extra semicolon outside of a function

Without this change, compiling with gcc and pedantic generates warning:
ISO C does not allow extra ‘;’ outside of a function.

merge: lock index during the merge (not just checkout)

allocations: test for overflow of requested size

Fixups for rebase

Provide git_indexwriter_init_for_operation for the common locking
pattern in merge, rebase, revert and cherry-pick.

Always lock the index when we begin the merge, before we write
any of the metdata files.  This prevents a race where another
client may run a commit after we have written the MERGE_HEAD but
before we have updated the index, which will produce a merge
commit that is treesame to one parent.  The merge will finish and
update the index and the resultant commit would not be a merge at
all.

Introduce `git_indexwriter`, to allow us to lock the index while
performing additional operations, then complete the write (or abort,
unlocking the index).

Correct the merge failed cleanup test.  Merge data should not be
cleaned up on conflicts, only on actual failure.  And ORIG_HEAD
should not be removed at all.

Switch to a standard branch-switching pattern of a `SAFE` checkout,
then updating `HEAD`.

Don't require the branch to rebase, if given `NULL`, simply look up
`HEAD`.

Users may want to try to pay attention to the `exec` field on all
rebase operations.

win32: limit the mode to `_wopen`/`_waccess`

gcc and clang support __builtin_add_overflow, use it whenever
possible, falling back to our naive routines.

Make our overflow checking look more like gcc and clang's, so that
we can substitute it out with the compiler instrinsics on platforms
that support it.  This means dropping the ability to pass `NULL` as
an out parameter.

As a result, the macros also get updated to reflect this as well.

Win32 generally ignores Unix-like mode bits that don't make any
sense on the platform (eg `0644` makes no sense to Windows).  But
WINE complains loudly when presented with POSIXy bits.  Remove them.

(Thanks @phkelley)

Reinit `reader` pointer after reading included config file

Fix build warning on Android

https://github.com/attractivechaos/klib/pull/42/files introduces
`kreallocarray`.  Hook that up as our `git__reallocarray`.

Add some helper functions to check for overflow in a type-specific
manner.

Ensure that the given length to `p_read` is of ssize_t and ensure
that callers test the return as if it were an `ssize_t`.

Use `size_t` to hold the size of arrays to ease overflow checking,
lest we check for overflow of a `size_t` then promptly truncate
by packing the length into a smaller type.