Move to statically link libgit2

This also adds a submodule so we know which version of libgit2 we're building against. Statically linking libgit2 gets us closer to the way Go does things.

We do however still link dynamically with libgit2's dependencies, namely openssl and libssh2 if available.
shouldn't this point to `"vendor/libgit2/include/git2.h"` instead?