This refactors the diff output code so that an iterator object can be used to traverse and generate the diffs, instead of just the `foreach()` style with callbacks. The code has been rearranged so that the two styles can still share most functions. This also replaces `GIT_REVWALKOVER` with `GIT_ITEROVER` and uses that as a common error code for marking the end of iteration when using a iterator style of object.
SSL_get_error() allows to receive a result code for various SSL operations. Depending on the return value (see man (3) SSL_get_error) there might be additional information in the OpenSSL error queue. Return the queued message if available, otherwise set an error message corresponding to the return code.
There is a better and less fragile way to calculate time offsets. Let the OS take care of dealing with DST and simply take the the offset between the local time and UTC that it gives us.
Passing SSL_VERIFY_PEER makes OpenSSL shut down the connection if the certificate is invalid, without giving us a chance to ignore that error. Pass SSL_VERIFY_NONE and call SSL_get_verify_result if the user wanted us to check. When no CNs match, we used to jump to on_error which gave a bogus error as that's for OpenSSL errors. Jump to cert_fail so we tell the user that the error came from checking the certificate.
This expands the types of peeling that `git_object_peel` knows how to do to include TAG -> BLOB peeling, and makes the errors slightly more consistent depending on the situation. It also adds a new special behavior where peeling to ANY will peel until the object type changes (e.g. chases TAGs to a non-TAG). Using this expanded peeling, this replaces peeling code that was embedded in `git_tag_peel` and `git_reset`.