Signed-off-by: David Turner <dturner@twosigma.com>

WinHTTP: support best auth mechanism

For username/password credentials, support NTLM or Basic (in that order
of priority).  Use the WinHTTP built-in authentication support for both,
and maintain a bitfield of the supported mechanisms from the response.

Fix handling of GIT_CHECKOUT_DISABLE_PATHSPEC_MATCH flag.

merge: set default rename threshold

giterr_set: consistent error messages

fix examples/network/clone.c: heap-buffer-overflow

security updates for v0.25

None of our crypto backends actually reject RC4 as a cipher so don't
test for it and instead keep it as something we'd like to do.

We must make sure that we're getting a certificate error from the
library so we know that we're testing the right thing.

Format of a length of string to the correct format is:%.*s

The Git protocol does not specify what should happen in the case
of an empty packet line (that is a packet line "0004"). We
currently indicate success, but do not return a packet in the
case where we hit an empty line. The smart protocol was not
prepared to handle such packets in all cases, though, resulting
in a `NULL` pointer dereference.

Fix the issue by returning an error instead. As such kind of
packets is not even specified by upstream, this is the right
thing to do.

Each packet line in the Git protocol is prefixed by a four-byte
length of how much data will follow, which we parse in
`git_pkt_parse_line`. The transmitted length can either be equal
to zero in case of a flush packet or has to be at least of length
four, as it also includes the encoded length itself. Not
checking this may result in a buffer overflow as we directly pass
the length to functions which accept a `size_t` length as
parameter.

Fix the issue by verifying that non-flush packets have at least a
length of `PKT_LEN_SIZE`.

Make sure that the callbacks do also get a 'valid' value of zero when
the certificate we're looking at is in valid and assert that within the
test.

Mention field addition in breaking API changes

When `GIT_MERGE_FIND_RENAMES` is set, provide a default for
`rename_threshold` when it is unset.

Allow Windows with WinHTTP to use external http-parser

Fix issue #4046 Seg fault in config_files()

Fix BIO_* functions method linking when compiled with libressl (OpenBSD).

git_checkout_tree() sets up its working directory iterator to respect the
pathlist if GIT_CHECKOUT_DISABLE_PATHSPEC_MATCH is present, which is great.
What's not so great is that this iterator is then used side-by-side with
an iterator created by git_checkout_iterator(), which did not set up its
pathlist appropriately (although the iterator mirrors all other iterator
options).

This could cause git_checkout_tree() to delete working tree files which
were not specified in the pathlist when GIT_CHECKOUT_DISABLE_PATHSPEC_MATCH
was used, as the unsynchronized iterators causes git_checkout_tree() to think
that files have been deleted between the two trees.  Oops.

And added a test which fails without this fix (specifically, the final check
for "testrepo/README" to still be present fails).

Error messages should be sentence fragments, and therefore:

1. Should not begin with a capital letter,
2. Should not conclude with punctuation, and
3. Should not end a sentence and begin a new one

rebase: check the result code of rebase_init_merge

mempack: set the odb backend version

ref:
https://github.com/gentoo/libressl/blob/672ac74ce7b7cb2e4799b2d66bc0b1b1efa3454e/media-video/ffmpeg/files/ffmpeg-3.2-libressl.patch

Documentation fixes

http: bump the pretend git version in the User-Agent

We want to keep the git UA in order for services to recognise that we're
a Git client and not a browser. But in order to stop dumb HTTP some
services have blocked UAs that claim to be pre-1.6.6 git.

Thread these needles by using the "git/2.0" prefix which is still close
enough to git's yet distinct enough that you can tell it's us.