C11 warnings

Dynamically load OpenSSL (optionally)

Add Xenial, Bionic, CentOS 7 and 8 workflows with OpenSSL-Dynamic builds
nightly.

Defer dlopen until it's needed when dynamically loading OpenSSL
libraries.

The ntlmclient dependency can now dynamically load OpenSSL.

dlopen sets up some thread-local state that isn't cleaned up by
`dlclose`.  Additionally, now that we're linking against different
versions of libssh2 and OpenSSL, we're seeing different leak signatures.

Provide an interface around OpenSSL to dynamically load the libraries
and symbols, so that users can distribute a libgit2 library that is not
linked directly against OpenSSL.  This enables users to target multiple
distributions with a single binary.

This mechanism is optional and disabled by default.  Configure cmake
with -DUSE_HTTPS=OpenSSL-Dynamic to use it.

Refactor the OpenSSL stream implementation so that the legacy code is better
abstracted.  This will enable future development.

ci: tag new containers with the latest tag

Update all the container versions to force a rebuild so that they'll get
tagged with latest (due to changes in the CI scripts).

ci: update centos builds

openssl: don't fail when we can't customize allocators

During valgrind runs, we try to swap out the OpenSSL allocators for our
own.  This allows us to avoid some unnecessary warnings about usage.
Unfortunately, many builds of OpenSSL do not allow you to swap
allocators; for example FIPS builds and the builds running in CentOS.

Try to swap the allocators, but do not fail when they cannot be
customized.

sha1dc: remove conditional for <sys/types.h>

ci: add centos 7 and centos 8

ci: update nightly to use source path

http: don't require a password

All the other workflows jobs check out into the `source` directory; do this in the documentation build job as well, for consistency across jobs.

Respect the force flag on refspecs in git_remote_fetch

docker: remove the entrypoint