config: document current write behaviour in a test

On set, we set/add the value written to the config's internal values,
but we do not refresh old values.

Document this in a test in preparation for the refresh changes.
config: implement config snapshotting

In order to have consistent views of the config files for remotes,
submodules et al. and a configuration that represents what is currently
stored on-disk, we need a way to provide a view of the configuration
that does not change.

The goal here is to provide the snapshotting part by creating a
read-only copy of the state of the configuration at a particular point
in time, which does not change when a repository's main config changes.
Use config snapshotting

This way we can assume we have a consistent view of the config situation
when we're looking up remote, branch, pack-objects, etc.
config: make refresh atomic

Current code sets the active map to a new one and builds it whilst it's
active. This is a race condition with someone else trying to access the
same config.

Instead, let's build up our new map and swap the active and new one.
config: split out the refresh step

This will be used by the writing commands in a later step.
config: use a snapshot for the iterator
config: refresh the values on write

When writing out, parse the resulting file instead of adding or
replacing the value locally. This has the effect of reading external
changes as well.
config: refresh before reading a value

With the isolation of complex reads, we can now try to refresh the
on-disk file before reading a value from it.

This changes the semantics a bit, as before we could be sure that a
string we got from the configuration was valid until we wrote or
refreshed. This is no longer the case, as a read can also invalidate the
pointer.
config: document the how long the pointers are valid for
config: refresh on delete

When we delete an entry, we also want to refresh the configuration to
catch any changes that happened externally.

This allows us to simplify the logic, as we no longer need to delete
these variables internally. The whole state will be refreshed and the
deleted entries won't be there.
config: refcount the values map

This is mostly groundwork to let us re-use the map in the snapshots.
config: share the strmap on snapshot

Now that our strmap is no longer modified but replaced, we can use the
same strmap for the snapshot's values and it will be freed when we don't
need it anymore.
netops: unit-test the cert host-name pattern matching

This kind of stuff should have unit tests, even if it's just to show
what we expect to match successfully.
netops: provide more specific error for cert failure

Specify what we do not like about the certificate. In this case, we do
not like the name.
netops: catch the server not sending a certificate

It's possible for an encrypted connection not have a certificate. In
this case, SSL_get_verify_result() will return OK because no error
happened (as it never even tried to validate anything).

SSL_get_peer_certificate() will return NULL in this case so we need to
catch that. On the upside, the current code would segfault in this
situation instead of letting it through as a valid cert.
Add filter options and ALLOW_UNSAFE

Diff and status do not want core.safecrlf to actually raise an
error regardless of the setting, so this extends the filter API
with an additional options flags parameter and adds a flag so that
filters can be applied with GIT_FILTER_OPT_ALLOW_UNSAFE, indicating
that unsafe filter application should be downgraded from a failure
to a warning.
repository: introduce a convenience config snapshot method

Accessing the repository's config and immediately taking a snapshot of
it is a common operation, so let's provide a convenience function for
it.
Use unsigned type for APIs with opt flag mask
cmake: s/ICONV/Iconv/ in FIND_PACKAGE

The cmake module we provide is in the file FindIconv.cmake,
so we must match the case correctly. It happens to work in
practice because we only turn on ICONV on Darwin, and people
generally have case-insensitive filesystems there.

Note that we only need to update the package name here. The
package itself still sets the all-uppercase ICONV_FOUND
flag, so we continue to use uppercase in the rest of cmake.
examples: add a basic for-each-ref example

This is quite close to running "git for-each-ref" except:

  1. It does not take any formatting or selection options at
     all.

  2. The output is not sorted.

I wrote it to look at debugging some issues with ref
iteration, but there's no reason it can't live on as an
example command.