Fix MAX 32 bit build problem described in libgit2/libgit2#2917

Fix race in git_packfile_unpack.

Streaming filters

Introduce GITTEST_INVASIVE_FS_STRUCTURE for things that are invasive
to your filesystem structure (like creating folders at your filesystem
root) and GITTEST_INVASIVE_FS_SIZE for things that write lots of data.

Refactor `git_filter_list__load_with_attr_reader` into
`git_filter_list__load_ext`, which takes a `git_filter_options`.

For consistency with the rest of the library, where an opt is an
options *structure*.

Provide a convenience function that creates a buffer that can be provided
to callers but will not be freed via `git_buf_free`, so the buffer
creator maintains the allocation lifecycle of the buffer's contents.

Fix Mac build without OpenSSL

Test pushing a file on-disk into a streaming filter that compresses
it into the ODB, and inflates it back into the working directory.

Let the filters use the checkout data's temporary buffer, instead
of having to allocate new buffers each time.

Use the new streaming filter API during checkout.

Migrate the `git_filter_list_apply_*` functions over to using the
new filter streams.

If OpenSSL is disabled on Mac the SHA1 implementation goes
to the CommonCrypto from the system. In this case we should
not include the generic hash impl. Otherwise there would be
duplicated impls which fail the build.

Add structures and preliminary functions to take a buffer, file or
blob and write the contents in chunks through an arbitrary number
of chained filters, finally writing into a user-provided function
accept the contents.

Remove extra semicolon outside of a function

Without this change, compiling with gcc and pedantic generates warning:
ISO C does not allow extra ‘;’ outside of a function.

Increment refcount of newly added cache entries just like existing
entries looked up from the cache. Otherwise the new entry can be
evicted from the cache and destroyed while it's still in use.

merge: lock index during the merge (not just checkout)

allocations: test for overflow of requested size

Fixups for rebase

Provide git_indexwriter_init_for_operation for the common locking
pattern in merge, rebase, revert and cherry-pick.

Always lock the index when we begin the merge, before we write
any of the metdata files.  This prevents a race where another
client may run a commit after we have written the MERGE_HEAD but
before we have updated the index, which will produce a merge
commit that is treesame to one parent.  The merge will finish and
update the index and the resultant commit would not be a merge at
all.

Introduce `git_indexwriter`, to allow us to lock the index while
performing additional operations, then complete the write (or abort,
unlocking the index).

Correct the merge failed cleanup test.  Merge data should not be
cleaned up on conflicts, only on actual failure.  And ORIG_HEAD
should not be removed at all.

Switch to a standard branch-switching pattern of a `SAFE` checkout,
then updating `HEAD`.

Don't require the branch to rebase, if given `NULL`, simply look up
`HEAD`.

Users may want to try to pay attention to the `exec` field on all
rebase operations.

win32: limit the mode to `_wopen`/`_waccess`

gcc and clang support __builtin_add_overflow, use it whenever
possible, falling back to our naive routines.