Plug memory leaks

This patch is mostly about making sure that we free the copies of what
we have, as well as making sure that we can free it.

The IndexEntry forgot to free its path, but it also used a pointer to
python-owned memory, which could be freed at any time.

MergeResult completely lacked a deallocator.

Signature needs to make sure we can free the enocoding, and not to set
an owner when we own the memory (in this case for the default
signature).

The repository needs to get rid of its reference to the object list when
returning.

The transfer progress callback needs to decref the stats object.