ssl: clear the OpenSSL locking function

We're freeing the memory which holds the locks so we must make sure that
the locking function doesn't try to use it.
ssl: separate locking init from general init

Extract the lock-setting functions into their own, as we cannot assume
that it's ok for us to set this unconditionally.
docs: explicitly document the threading caveats

Talk about sharing objects and error messages; but the most important
part is about what to do with the cryptographic libraries, which sadly
have to become to responsibility of the application.
remote: add a failing test for checking the current branch's upstream

When we update FETCH_HEAD we check whether the remote is the current
branch's upstream remote. The code does not check whether the current
refspec is relevant for this reference but always tries to perform the
reverse transformation, which causes it to error out if the refspec
doesn't match the reference.

Thanks to Pierre-Olivier Latour for the reproduction recipe.
remote: check the relevance of the refspec when updating FETCH_HEAD

Before trying to rtransform using the given refspec to figure out what
the name of the upstream branch is on the remote, we must make sure that
the target of the refspec applies to the current branch's upstream.
ignore: consider files with a CR in their names

We currently consider CR to start the end of the line, but that means
that we miss cases with CR CR LF which can be used with git to match
files whose names have CR at the end of their names.

The fix from the patch comes from Russell's comment in the issue.

This fixes #2536.
Merge pull request #2688 from libgit2/cmn/ignore-file-trailing-cr

ignore: consider files with a CR in their names
ignore: add failing test for a file mentioning the parent

When we mention "src" in src/.gitignore, we wrongly consider src/ itself
to be ignored.
ignore: don't leak rules into higher directories

A rule "src" in src/.gitignore must only match subdirectories of
src/. The current code does not include this context in the match rule
and would thus consider this rule to match the top-level src/ directory
instead of the intended src/src/.

Keep track fo the context in which the rule was defined so we can
perform a prefix match.
Merge pull request #2682 from libgit2/cmn/fetch-tags-refspec

remote: check for the validity of the refspec when updating FETCH_HEAD
Merge pull request #2676 from libgit2/cmn/threading

Threading and crypto libraries
Merge pull request #2598 from libgit2/cmn/stacked-ignore

ignore: don't leak rules into higher directores