Look at actual refs to track if repos were updated

We are currently executing the update-hook regardless of whether there
were actual updates in the repositories we track via grok-dumb-pull.
This creates unnecessary churn, so look at ref-parse before and after
the git pull to figure out if there were any actual updates in the
repository before calling the update-hook.
Add a feature to ignore references during initial cloning

When cloning for backup purposes, it is wise to ignore any repository
sharing and just clone wholesale, regardless of size on disk. Now one
can set ignore_repo_references option.
Fix bogus date in the specfile
And don't set the alternates on next run, either
Fix traceback on local manifest location
Prevent grok-pulls from snowballing on multiple runs
Fix wrong logging message
Don't remove lockfiles, to avoid lock contention
Initial repository "fingerprint" implementation

A continuous problem is recognizing whether master and mirrors are the
same. We are relying on timestamps, but they are external to the git
repository itself and therefore aren't as reliable as data we can get
directly out of git. Comparing the output of "git show-ref" is one way
of comparing the state of two git repositories -- if the output is the
same, then the repositories should be identical, at least in terms of
refs.

Since the order of "git show-ref" is deterministic, it should be
reliable to use the hash of the output as a makeshift "repository
fingerprint", which we now rely on to make sure our mirrors match the
master.
Raise pre number in spec
First set of improvements for fingerprint support
Implement --verify-mirror with --verify-subpath
Document the verify feature and bump spec
Write out fingerprints when generating them for manifest

Otherwise we recalculate them live on each run, and it takes ages on
large collections.
Fix traceback when a repo couldn't be locked
Remember to unlock repos in verify stage
Add some info to output during compare stage
Tweaks to improve fingerprinting
Get out early when too many locked repos

No need to continue scanning for changed repositories when we already
know that there are too many locked repos. Get out and let the next
process try again.
Make sure we don't record the wrong fingerprint