memory leak refspec.c

Remove some warnings

Submodule and http fixes

When the server rejects an authentication request, ask the caller for
the credentials again, instead of giving up on the first try.

We allow looking up a submodule by path, but we lost the path
normalisation during the recent changes. Bring it back.

Remove some of the logic that was left-over from the time we had a cache
of submodules, plugging a leak of the submodule object in certain cases.

pkg-config: Sort the different sections

Because of the fact that pkg-config is pants-on-head retarded and that
the Linux linker *requires* a static library to come before all its
dynamic dependencies in the link path, calling `pkg-config --libs
--static` was generating the wrong flags for linking.

Before this patch:

	-Wl,-Bsymbolic-functions -Wl,-z,relro -L/usr/local/lib -lcurl -lssh2
	-lrt -lgit2 -lssl -lcrypto -ldl -lz

After this patch:

	-Wl,-Bsymbolic-functions -Wl,-z,relro -L/usr/local/lib -lgit2 -lcurl
	-lssh2 -lrt -lssl -lcrypto -ldl -lz

By setting the "Libs" line before all other rules, we make sure that
`-lgit2` is the first library in the link path and that it gets its
symbols resolved with the libraries coming after it.

This fix (ab)uses an implementation detail in `pkg-config` (namely, that
flags are output as they are found on the file), but this detail seems
to be stable between releases and always gives a stable output.

CMake: treat the ld flags as a list

These are treated as a list by CMake itself, which means that treating
them as a simple string can put semicolons in our ld command-line if we
have libraries which are not installed on the standard locations.

Treat the variable as a CMake list and replace it with the space-delimited
list just before writing it out to our pc file.

Plug a bunch of leaks

stash: test we apply using reflog-like indices

Fast builds?

We're installing dependencies via the APT addon now.

Fixes