Fix repo init when template dir is non-existent

Introduce `git_fs_path`, which operates on generic filesystem paths.
`git_path` will be kept for only git-specific path functionality (for
example, checking for `.git` in a path).

libgit2 has two distinct requirements that were previously solved by
`git_buf`.  We require:

1. A general purpose string class that provides a number of utility APIs
   for manipulating data (eg, concatenating, truncating, etc).
2. A structure that we can use to return strings to callers that they
   can take ownership of.

By using a single class (`git_buf`) for both of these purposes, we have
confused the API to the point that refactorings are difficult and
reasoning about correctness is also difficult.

Move the utility class `git_buf` to be called `git_str`: this represents
its general purpose, as an internal string buffer class.  The name also
is an homage to Junio Hamano ("gitstr").

The public API remains `git_buf`, and has a much smaller footprint.  It
is generally only used as an "out" param with strict requirements that
follow the documentation.  (Exceptions exist for some legacy APIs to
avoid breaking callers unnecessarily.)

Utility functions exist to convert a user-specified `git_buf` to a
`git_str` so that we can call internal functions, then converting it
back again.

When `git_repository_hashfile` is handed an absolute path, it determines
whether the path is within the repository's working directory or not.
This is necessary when there is no `as_path` specified.

If the path is within the working directory, then the given path should
be used for attribute lookups (it is the effective `as_path`).  If it is
not within the working directory, then it is _not_ eligible.

Importantly, now we will _never_ pass an absolute path down to attribute
lookup functions.

Allow users to specify additional repository extensions that they want
to support.  For example, callers can specify that they support
`preciousObjects` and then may open repositories that support
`extensions.preciousObjects`.

Similarly, callers may opt out of supporting extensions that the library
itself supports.

Working directory path validation

Ensure that a repository's path (at initialization or open time) is
valid.  On Windows systems, this means that the longest known path
beneath the repository will fit within MAX_PATH: this is a lock file for
a loose object within the repository itself.

Other paths, like a very long loose reference, may fail to be opened
after the repository is opened.  These variable length paths will be
checked when they are accessed themselves.  This new functionality is
done at open to prevent needlessly checking every file in the gitdir
(eg, `MERGE_HEAD`) for its length when we could instead check once at
repository open time.

We already do this in repo_init_head