ssh: detect authentication methods

Before calling the credentials callback, ask the sever which
authentication methods it supports and report that to the user, instead
of simply reporting everything that the transport supports.

In case of an error, we do fall back to listing all of them.
ssh: propagate the error code from the auth callback

We need to be able to get a GIT_EUSER back through the outermost call.
Introduce GIT_EAUTH

Introduce this error code to signal an authentication failure.
ssh: request credentials again on authentication failure

Instead of completely giving up on the first failure, ask for
credentials as long as we fail to authenticate.
cred: introduce username-only cred

This exists as ssh needs to know about the username to use before it can
query for the supported authentication methods.
cred: add convenience function to get the username

Since each cred defines the username on their own, introduce
git_cred__username to retrieve the username pointer from them.
ssh: make sure to ask for a username and use the same one

In order to know which authentication methods are supported/allowed by
the ssh server, we need to send a NONE auth request, which needs a
username associated with it.

Most ssh server implementations do not allow switching the username
between authentication attempts, which means we cannot use a dummy
username and then switch. There are two ways around this.

The first is to use a different connection, which an earlier commit
implements, but this increases how long it takes to get set up, and
without knowing the right username, we cannot guarantee that the
list we get in response is the right one.

The second is what's implemented here: if there is no username specified
in the url, ask for it first. We can then ask for the list of auth
methods and use the user's credentials in the same connection.
ssh: adjust clone and push test credentials to the split user+pass method

For urls where we do not specify a username, we must handle the case
where the ssh transport asks us for the username.

Test also that switching username fails.
travis: enable password authentication on OSX

Our ssh tests assume that the server supports password authentication
in a few places. This is convenient as we're not testing authentication
methods, but what happens around them.

Tell sshd on OSX to accept this form of authentication.
merge: expose multiple merge bases

We always calculate multiple merge bases, but up to now we had only
exposed the "best" merge base.

Introduce git_oidarray which analogously to git_strarray lets us return
multiple ids.
Fix rejection of parent dir of negated ignores

While scanning through a directory hierarchy, this prevents a
positive ignore match on a parent directory from blocking the scan
of a directory when a negative match rule exists for files inside
the directory.
status: failing test with slash-star

When writing 'bin/*' in the rules, this means we ignore very file inside
bin/ individually, but do not ignore the directory itself. Thus the
status listing should list both files under bin/, one untracked and one
ignored.
For negative matches, always use leading dir match
Demonstrate a trailing slash failure.

`git help ignore` has this to say about trailing slashes:

> If the pattern ends with a slash, it is removed for the purpose of
> the following description, but it would only find a match with a
> directory. In other words, foo/ will match a directory foo and
> paths underneath it, but will not match a regular file or a
> symbolic link foo (this is consistent with the way how pathspec
> works in general in Git).

Sure enough, having manually performed the same steps as this test,
`git status` tells us the following:

	# On branch master
	#
	# Initial commit
	#
	# Changes to be committed:
	#   (use "git rm --cached <file>..." to unstage)
	#
	#	new file:   force.txt
	#
	# Untracked files:
	#   (use "git add <file>..." to include in what will be committed)
	#
	#	../.gitignore
	#	child1/
	#	child2/

i.e. neither child1 nor child2 is ignored.
Removing a completed starter project.

Removing the starter project for adding support for the symref
extension (#2006) from PROJECTS.md, as this seems to have been
completed with the merge of #2376.
http: make sure we can consume the data we request

The recv buffer (parse_buffer) and the buffer have independent sizes and
offsets. We try to fill in parse_buffer as much as possible before
passing it to the http parser. This is fine most of the time, but fails
us when the buffer is almost full.

In those situations, parse_buffer can have more data than we would be
able to put into the buffer (which may be getting full if we're towards
the end of a data sideband packet).

To work around this, we check if the space we have left on our buffer is
smaller than what could come from the network. If this happens, we make
parse_buffer think that it has as much space left as our buffer, so it
won't try to retrieve more data than we can deal with.

As the start of the data may no longer be at the start of the buffer, we
need to keep track of where it really starts (data_offset) and use that
in our calculations for the real size of the data we received from the
network.

This fixes #2518.
Check if the refspec matches before transforming
Merge pull request #2523 from leighlondon/remove-completed-project

Removing a completed starter project.
Merge pull request #2525 from libgit2/cmn/http-recv-buffer

http: make sure we can consume the data we request
oid: Export `git_oid_tostr_s` instead of `_allocfmt`

The old `allocfmt` is of no use to callers, as they are not able to free
the returned buffer. Export a new API that returns a static string that
doesn't need to be freed.