Add read-only support for local Git bundle files - #7338

Reconstruct the generic no-HEAD clone behavior proposed as part of
libgit2 pull request libgit2#7101 by Laurence McGlashan.  This is deliberately
kept as a separate, independently green baseline commit so that the
earlier contribution remains recognizable and the later decision to
preserve libgit2's existing behavior can be reviewed as an explicit
delta instead of being silently folded into the bundle implementation.

When a remote advertises no HEAD, clone leaves the configured initial
branch unborn even when that exact branch was just fetched.  Select and
check out the configured initial branch in that case: look for the
configured `refs/heads/<name>` among the advertised references and,
when it is present, go through clone's existing explicit-branch path so
the local branch, its upstream, and the checkout are all set up in the
usual way.

When the configured name was not advertised, keep the current behavior
and leave it unborn.  Do not substitute the only branch, the first
branch, or an OID match.  Do not create `refs/remotes/origin/HEAD`,
because the remote did not advertise one.

The policy is generic rather than bundle-specific, so test it through a
custom transport that omits HEAD.

A remote whose own HEAD is unborn reaches the same path because a
reference without an object ID cannot be advertised.  This therefore
checks out the configured initial branch where libgit2 previously left
HEAD unborn.  Git distinguishes these cases because upload-pack sends
an unborn HEAD's symref target as a capability, but libgit2's transports
do not currently carry that information.  The later delta in this
series backs out this policy change rather than accepting that ambiguity.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017U2Kqd137huTh2hdkWERds

Add an internal parser for v2 and v3 bundle headers: the version, the
object format, the prerequisite object ids, the advertised references
in header order, and the offset of the first byte of the pack.

The parser reads through a small callback abstraction rather than from
a descriptor, with a file-descriptor backing and an in-memory backing.
That keeps the parser tests free of temporary files and is the
precondition for a header-parser fuzz target, which consumes a buffer
and would otherwise need one temporary file per iteration.  Lines are
read incrementally, so neither the header nor the pack is ever held in
a single buffer.

The result codes are what transport probing will need: `GIT_EINVALID`
for input that is not a bundle or whose header is malformed,
`GIT_ENOTSUPPORTED` for a well-formed bundle this build cannot use (a
filtered bundle, an unknown v3 capability, or an unsupported object
format), and any other negative value for an operational failure.  An
unsupported capability does not stop syntax checking, so a file that is
both malformed and unsupported is reported as malformed.

Based on the work in libgit2 pull request libgit2#7101 by Laurence McGlashan.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017U2Kqd137huTh2hdkWERds

Add a read-only transport that serves references and objects from a
local git bundle, so a bundle path can be used wherever a remote is
accepted.  Both self-contained and incremental bundles work, in SHA1
and SHA256.

There is no URL scheme.  A bundle is recognized by its contents, so any
path works whatever its extension, matching how the Git command line
takes a bundle.  Probing runs before the colon-based SSH fallback,
which is what lets a Windows drive-rooted path be recognized; the
local-path predicate rejects scp-style `host:path` strings without
touching the filesystem, so genuine SSH remotes still avoid the probe.
Probing classifies the path before opening it: a missing path, a
directory, or any other non-regular file falls through silently, as
does a regular file that is not a bundle, but allocation, permission,
and read failures on an existing regular file are propagated rather
than turned into "unsupported URL protocol".  A well-formed bundle we
cannot use still selects the transport, so connect can report the
specific reason.

A recorded HEAD is advertised first; a missing one is not invented,
matching what `git ls-remote` reports for a bundle.  Bundle references
carry no symref information, so a recorded HEAD is resolved by its
object id through the existing default-branch logic, and clone's
no-HEAD fallback handles the rest.

Prerequisites are checked for existence in the destination object
database before the pack is created, which is what Git 2.50.1 does when
it unbundles, although the `git bundle verify` manual uses the stronger
"fully linked" wording.  Thin-pack resolution against the destination
remains the backstop for a delta base that is genuinely missing.  When
every wanted tip already exists locally the generic fetch path asks the
transport for nothing, so unused prerequisites are not checked; that
gap is covered by a test rather than papered over.

Both callbacks the fetch path invokes unconditionally are implemented.
`negotiate_fetch` rejects a requested depth and an already-shallow
destination before anything is verified or ingested -- the latter
because writing a bundle's empty shallow-root list would delete the
destination's `shallow` file -- and compares object formats.
`shallow_roots` is a no-op that would otherwise crash every successful
fetch.

Cancellation is reset when a connection or a negotiation begins, so
`git_remote_stop` cancels the operation in flight without poisoning a
transport the caller wants to reuse.  This is deliberately more than
the smart and local transports do; neither ever clears its flag.

Based on the work in libgit2 pull request libgit2#7101 by Laurence McGlashan,
incorporating the review of pull request libgit2#7221: no invented URL scheme,
and HEAD advertised first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017U2Kqd137huTh2hdkWERds

Record what came out of implementing the plan: the deviations, the one
behaviour change the plan did not anticipate, the test-matrix entries
that are not covered, and two follow-ups.

Reject over-long bundle header lines instead of reading unbounded input,
and stop picking the configured initial branch when a clone's remote
advertises no HEAD; leave HEAD at the repository default instead.

Rescan only newly read bytes when looking for a newline, parse oids in
place, and propagate odb errors from the prerequisite check.  Limit the
drive-letter probe to Windows so it runs before the SSH colon check only
there, and clear the cancel flag so it cannot leak into a later fetch.