When considering status of untracked directories, if we find an
explicitly ignored item, even if it is a directory, treat the
parent as an IGNORED item.  It was accidentally being treated as
an EMPTY item because we were not looking into the ignored subdir.

In the iterator, distinguish between ignores and empty directories
so that diff and status can ignore empty directories, but checkout
and stash can treat them as untracked items.

When diff finds an untracked directory, it emulates Git behavior
by looking inside the directory to see if there are any untracked
items inside it. If there are only ignored items inside the dir,
then diff considers it ignored, even if there is no direct ignore
rule for it.

Checkout was not copying this behavior - when it found an untracked
directory, it just treated it as untracked.  Unfortunately, when
combined with GIT_CHECKOUT_REMOVE_UNTRACKED, this made is seem that
checkout (and stash, which uses checkout) was removing ignored
items when you had only asked it to remove untracked ones.

This commit moves the logic for advancing past an untracked dir
while scanning for non-ignored items into an iterator helper fn,
and uses that for both diff and checkout.

To emulate git, stash should not remove untracked git repositories
inside the parent repo, and checkout's REMOVE_UNTRACKED should
also skip over these items.

`git stash` actually prints a warning message for these items.
That should be possible with a checkout notify callback if you
wanted to, although it would require a bit of extra logic as things
are at the moment.

A few niceties for binding authors

Allow the credentials callback to return GIT_PASSTHROUGH to make the
transports code behave as though none was set.

This should make it easier for bindings to behave closer to the C code
when there is no credentials callback set at their level.

This should make it easier for bindings to dynamically override their
own callbacks.

Fix some issues from the last Coverity scan

Fix reset for staged deletes