ssl: clear the OpenSSL locking function

We're freeing the memory which holds the locks so we must make sure that
the locking function doesn't try to use it.
ssl: separate locking init from general init

Extract the lock-setting functions into their own, as we cannot assume
that it's ok for us to set this unconditionally.
docs: explicitly document the threading caveats

Talk about sharing objects and error messages; but the most important
part is about what to do with the cryptographic libraries, which sadly
have to become to responsibility of the application.
remote: add a failing test for checking the current branch's upstream

When we update FETCH_HEAD we check whether the remote is the current
branch's upstream remote. The code does not check whether the current
refspec is relevant for this reference but always tries to perform the
reverse transformation, which causes it to error out if the refspec
doesn't match the reference.

Thanks to Pierre-Olivier Latour for the reproduction recipe.
remote: check the relevance of the refspec when updating FETCH_HEAD

Before trying to rtransform using the given refspec to figure out what
the name of the upstream branch is on the remote, we must make sure that
the target of the refspec applies to the current branch's upstream.
ignore: add failing test for a file mentioning the parent

When we mention "src" in src/.gitignore, we wrongly consider src/ itself
to be ignored.
ignore: don't leak rules into higher directories

A rule "src" in src/.gitignore must only match subdirectories of
src/. The current code does not include this context in the match rule
and would thus consider this rule to match the top-level src/ directory
instead of the intended src/src/.

Keep track fo the context in which the rule was defined so we can
perform a prefix match.
Merge pull request #2682 from libgit2/cmn/fetch-tags-refspec

remote: check for the validity of the refspec when updating FETCH_HEAD
Merge pull request #2676 from libgit2/cmn/threading

Threading and crypto libraries
Merge pull request #2598 from libgit2/cmn/stacked-ignore

ignore: don't leak rules into higher directores
checkout_index: remove conflicts when checking out new files
checkout_index: Remove stage 0 when checking out conflicts
Merge pull request #2692 from ethomson/bug2515

checkout_index: handle other stages
submodules: add failing test for stale module entries

We consider an entry in .gitmodules to mean that we have a submodule at
a particular path, even if HEAD^{tree} and the index do not contain any
reference to it.

We should ignore that submodule entry and simply consider that path to
be a regular directory.
iterator: submodules are determined by an index or tree

We cannot know from looking at .gitmodules whether a directory is a
submodule or not. We need the index or tree we are comparing against to
tell us. Otherwise we have to assume the entry in .gitmodules is stale
or otherwise invalid.

Thus we pass the index of the repository into the workdir iterator, even
if we do not want to compare against it. This follows what git does,
which even for `git diff <tree>`, it will consider staged submodules as
such.