@vmg Since this assert properly caught a bogus pack file, and since the assert looks right, can you roll back that part of the commit?

It might be useful to put `assert(ofs < 20);` [here](https://github.com/libgit2/libgit2/blob/67591c8cd8d55e6f3218f1a734385c845459e1ff/src/sha1_lookup.c#L107).  That's a cheap way to catch (some) pack files with duplicates in them.