remote: allow overriding the refspecs for download and fetch

With opportunistic ref updates, git has introduced the concept of having
base refspecs *and* refspecs that are active for a particular fetch.

Let's start by letting the user override the refspecs for download.
remote: use active refspec override in the tests

This lets us test this bit as well as getting closer to what they were
trying to do.
remote: don't DWIM refspecs unnecessarily

We can only DWIM when we've connected to the remote and have the list of
the remote's references. Adding or setting the refspecs should not
trigger an attempt to DWIM the refspecs as we typically cannot do it,
and even if we did, we would not use them for the current fetch.
remote: store passive refspecs

The configured/base fetch refspecs need to be taken into account in
order to implement opportunistic remote-tracking branch updates. DWIM
them and store them in the struct, but don't do anything with them yet.
remote: implement opportunistic remote-tracking branch updates

When a list of refspecs is passed to fetch (what git would consider
refspec passed on the command-line), we not only need to perform the
updates described in that refspec, but also update the remote-tracking
branch of the fetched remote heads according to the remote's configured
refspecs.

These "fetches" are not however to be written to FETCH_HEAD as they
would be duplicate data, and it's not what the user asked for.
reflog: constify byindex
signature: add a dup function which takes a pool

This will be used by the transaction code.
Introduce reference transactions

A transaction allows you to lock multiple references and set up changes
for them before applying the changes all at once (or as close as the
backend supports).

This can be used for replication purposes, or for making sure some
operations run when the reference is locked and thus cannot be changed.
stash: use a transaction to modify the reflog

The stash is implemented as the refs/stash reference and its reflog. In
order to modify the reflog, we need avoid races by making sure we're the
only ones allowed to modify the reflog.

We achieve this via the transactions API. Locking the reference gives us
exclusive write access, letting us modify and write it without races.
transaction: add documentation
Add changelog for transactions
hashsig: Export as a `sys` header
Merge pull request #2594 from libgit2/vmg/hashsig

hashsig: Export as a `sys` header
p_mkdir != mkdir on win32
repository_head_unborn: clear error when HEAD is unborn
config: Fix multiple trailing spaces before comments not completely trimmed
config: Add test cases that have trailing spaces before comment chars
Fix README.md
Add git_merge_bases_many.
Extract shared functionality.