We did not properly support default credentials for proxies, only for
destination servers.  Refactor the credential handling to support sending
either username/password _or_ default credentials to either the proxy or
the destination server.

This actually shares the authentication logic between proxy servers and
destination servers.  Due to copy/pasta drift over time, they had
diverged.  Now they share a common logic which is: first, use
credentials specified in the URL (if there were any), treating empty
username and password (ie, "http://:@foo.com/") as default credentials,
for compatibility with git.  Next, call the credential callbacks.
Finally, fallback to WinHTTP compatibility layers using built-in
authentication like we always have.

Allowing default credentials for proxies requires moving the security
level downgrade into the credential setting routines themselves.
We will update our security level to "high" by default which means that
we will never send default credentials without prompting.  (A lower
setting, like the WinHTTP default of "medium" would allow WinHTTP to
handle credentials for us, despite what a user may have requested with
their structures.)  Now we start with "high" and downgrade to "low" only
after a user has explicitly requested default credentials.

There's no reason a git repository couldn't be at the root of a server,
and URLs should have an implicit path of '/' when one is not specified.

GitHub recently changed their behavior from returning 401s for private
or nonexistent repositories on a clone to returning 404s.  For our tests
that require an auth failure (and 401), move to GitLab to request a
missing repository.  This lets us continue to test our auth failure
case, at least until they decide to mimic that decision.

Update internal usage of `git_transfer_progress` to
`git_indexer_progreses`.

Move to the `git_error` name in the internal API for error-related
functions.

Update internal usage to use the `git_reference` names for constants.

For testing, we may wish to use a man-in-the-middle proxy that can
inspect the CONNECT traffic to our test endpoints.  For this, we will
need to accept the proxy's certificate, which will not be valid for the
true endpoint.

Add a new environment variable, GITTEST_REMOTE_SSL_NOVERIFY to disable
https certificate validation for the tests.

Rename credential callback to proxy_cred_cb to match new cert callback.

Give the proxy tests a proxy certificate callback, and allow self-signed
certificates when the `GITTEST_REMOTE_PROXY_SELFSIGNED` environment
variable is set (to anything).  In that case, simply compare the hostname
from the callback to the hostname that we connected to.