Move enhanced communicate() method out of extensions/

Also redesign it to make it a bit more flexible, notably supporting
a callback that (incrementally) returns stdin data, and support for
feeding stdout/stderr data to callbacks instead of buffering and
returning.
Redesign main() to return an iterable instead of being a generator

This makes all single-chunk cases slightly simpler.  The multiple-chunk
case (IOW pages that are generated and delivered incrementally) becomes
somewhat more complicated; they are handled by a small wrapper class
(WrappedResult) that implements the iterator protocol, and handles the
aggressive per-chunk database transaction rollback.

Ultimately, the primary purpose of the redesign is to support streaming
via the write callable returned by start_response().  Calling the write
callable from "within their return iterable" is not allowed, and that
would have been unavoidable with the generator-style main().
Support identifying user by $REMOTE_USER in pre-receive hook

The $REMOTE_USER value is used only if the user executing the hook is the
Critic system user.  This requires a minor protocol extension between the
pre-receive hook and the githook service, since the githook service can't
see the environment variable, and the pre-receive hook can't know if the
actual user is the Critic system user (not without importing Critic's
configuration module, that is, but import it is not possible.)
Support HTTP authentication even if session type is "cookie"

If there is no Cookie header, but there is a Authorization header, then
use the Authorization header to authenticate the user.  This allows parts
of the web front-end to request HTTP authentication instead of cookies,
which is typically easier for non-browser user agents to support.
Extend Request class to support using the WSGI "write callable"
Export Git repositories over HTTP using 'git http-backend'

If anonymous users are allowed, read-only access to the Git repositories
is supported without authentication.  Push is supported only with
authentication.
Use gitutils.Repository.{get,construct}URL() everywhere

... instead of constructing <hostname>:<path> repository URLs.

They return URLs in a user configurable format (git://, http://,
ssh:// or host:path.)  Which formats to let users chose between is
a system configuration option.
Extend 004-createreview.py to load plain /createreview too

Load /createreview without parameters, that is.  This generates a
completely different page than /createreview with parameters, so
quite worthwhile to test.
Extend 002-createrepository.py to test /repositories

The /repositories test under 001-main/001-empty is rather limited
since it loads it when there are no repositories (and no tracked
branches) and thus tests very little of the actual page rendering.