Add support for Git dependencies

[charliermarsh]

Summary

This PR adds support for Git dependencies, like:

flask @ git+https://github.com/pallets/flask.git

Right now, they're only supported in the resolver (and not the installer), since the installer doesn't yet support source distributions at all.

The general approach here is based on Cargo's Git implementation. Specifically, I adapted Cargo's git module to perform the cloning, which is based on libgit2.

As compared to Cargo's implementation, I made the following changes:

• Removed any unnecessary code.
• Fixed any Clippy errors for our stricter ruleset.
• Removed the dependency on curl, in favor of reqwest which we use elsewhere.
• Removed the ability to use gix. Cargo allows the use of gix as an experimental flag, but it only supports a small subset of the operations. When Cargo fully adopts gix, we should plan to do the same.
• Removed Cargo's host key checking. We need to re-add this! I'll do it shortly.
• Removed Cargo's progress bars. We should re-add this too, but we use indicatif and Cargo had their own thing.

There are a few follow-ups to consider:

• Adding support in the installer.
• When we lock, we should write out the Git URL that includes the exact SHA. This lets us cache in perpetuity and avoids dependencies changing without re-locking.
• When we resolve, we should always try to refresh Git dependencies. (Right now, we skip if the wheel was already built.)

I'll work on the latter two in follow-up PRs.

Closes #202.

[charliermarsh]

This file does the actual Git operations. It's largely derived from Cargo.

[charliermarsh]

The cool thing about Cargo's implementation is that they maintain a "database" of repositories. So every repository that you ever check out is included in there. Then, peer to it, they have a directory of checkouts, which are created by checking out the commit in the database and hardlinking from the database to the checkout. So it's fast to switch between commits of the same repository.

[charliermarsh]

There are so many issues about Cargo not working as expected with SSH dependencies that I'm wondering if we should just make this the default (rust-lang/cargo#2078, rust-lang/cargo#3381, etc.).

[charliermarsh]

(This would not remove our dependency on libgit2 since this is just the fetch.)

[konstin]

I didn't review the parts copied from cargo.

It's a pity that we copy the code and there's no reusable crate.

[charliermarsh]

@konstin - I agree although I'm actually happy with how little code we had to copy in the end. It may not feel that way from the review, but I was able to pare it down a lot. Now, we're really only borrowing the actual Git operations and logic around when to refresh, when to reset, recursively cloning submodules, etc., which at least feels somewhat domain agnostic.