`git_buf_sanitize` is called with user-input, and wants to sanity-check
that input.  Allow it to return a value if the input was malformed in a
way that we cannot cope.

When calling `git_note_next`, we end up calling `git_iterator_advance`
but ignore its error code. The intent is that we do not want to return
an error if it returns `GIT_ITEROVER`, as we want to return that value
on the next invocation of `git_note_next`. We should still check for any
other error codes returned by `git_iterator_advance` to catch unexpected
internal errors.

Fix this by checking the function's return value, ignoring
`GIT_ITEROVER`.

Instead of using a signed type (`off_t`) use a new `git_object_size_t`
for the sizes of objects.

The majority of functions are named `from_something` (with an
underscore) instead of `fromsomething`.  Update the blob functions for
consistency with the rest of the library.

Our blob size is a `git_off_t`, which is a signed 64 bit int.  This may
be erroneously negative or larger than `SIZE_MAX`.  Ensure that the blob
size fits into a `size_t` before casting.

Move to the `git_error` name in the internal API for error-related
functions.

C++ style comment ("//") are not specified by the ISO C90 standard and
thus do not conform to it. While libgit2 aims to conform to C90, we did
not enforce it until now, which is why quite a lot of these
non-conforming comments have snuck into our codebase. Do a tree-wide
conversion of all C++ style comments to the supported C style comments
to allow us enforcing strict C90 compliance in a later commit.