The `SSLCopyPeerTrust` call can succeed but fail to return a trust
object if it can't load the certificate chain and thus cannot check the
validity of a certificate. This can lead to us calling `CFRelease` on a
`NULL` trust object, causing a crash.

Handle this by returning ECERTIFICATE.

Since writing multiple objects may all already exist in a single
packfile, avoid freshening that packfile repeatedly in a tight loop.
Instead, only freshen pack files every 2 seconds.

When writing an object, we calculate its OID and see if it exists in the
object database.  If it does, we need to freshen the file that contains
it.

sysdir: don't assume an empty dir is uninitialized

Fix outdated comment

Enable https transport for custom TLS streams

Don't try to determine when sysdirs are uninitialized.  Instead, simply
initialize them all at `git_libgit2_init` time and never try to
reinitialize, except when consumers explicitly call `git_sysdir_set`.

Looking at the buffer length is especially problematic, since there may
no appropriate path for that value.  (For example, the Windows-specific
programdata directory has no value on non-Windows machines.)

Previously we would continually trying to re-lookup these values,
which could get racy if two different threads are each calling
`git_sysdir_get` and trying to lookup / clear the value simultaneously.

mwindow: init mwindow files in git_libgit2_init