Upstream libgit2 builtin sha256 may have race condition

[weihanglo]

This was found in

• https://github.com/rust-lang/git2-rs/actions/runs/25859716266/job/75986211798?pr=1206#step:6:237
• https://github.com/rust-lang/git2-rs/actions/runs/25944613082/job/76269915137?pr=1206#step:6:253
• https://github.com/rust-lang/git2-rs/actions/runs/25859252887/job/75984686679?pr=1206#step:6:237

during cargo test which the test harness libtest is multi-threaded.

thread 'indexer::tests::indexer_sha256' (11949) panicked at src/test.rs:36:14:
called `Result::unwrap()` on an `Err` value: Error { code: -33, klass: 9, message: "object hash mismatch - expected 7991f5e7c0692696aec4fdf250571006878b2667a3123fbdb5329653591af542 but got 831eed201a25d1677172d9c5e6cc953308062f5e007f5e9a28c0e38250c17d8b" }

Observed them failed on different toolchains and platforms, and only when unstable-sha256 is enabled with http feature deactivated.

After some investigation, I found that in upstream libgit2. It use a static addTemp which doesn't have any thread-safe mechanism around it: https://github.com/libgit2/libgit2/blob/d23f18fd881b8c5bb5e7a7abfcbc71ddf0c9a5ea/src/util/hash/rfc6234/sha224-256.c#L86-L91

Combined with the "without http feature" finding, I think that means the GIT_SHA256_BUILTIN is not thread safe. This is not too hard to reproduce by adjust test running in a fairly amount of threads (i.e., 16 or 32) and rerunning the entire test suite a couple of times.

cc #1206

[weihanglo]

Proposed an upstream fix: libgit2/libgit2#7266

[weihanglo]

libgit2/libgit2#7266 got fixed, but we may not have a new 1.9.x release. Probably just call out in changelog and feature comment in Cargo.toml

[weihanglo]

More:

• https://github.com/rust-lang/git2-rs/actions/runs/25999692503/job/76420680383?pr=1206#step:6:244

  thread 'diff::tests::diff_sha256' (11975) panicked at src/test.rs:36:14:
  

called Result::unwrap() on an Err value: Error { code: -33, klass: 9, message: "object hash mismatch - expected 25d79dffd655204c6813e1de3603e0d2c07ae3450455ada575bcaf10dedf367b but got 3abd2ca93d212dd61476a13411f04e5f7f8aa15984e14a6d0a91050799321e30" }

* `packbuilder::tests::insert_tree_write_sha256` — https://github.com/rust-lang/git2-rs/actions/runs/25999692503/job/76420458680?pr=1206#step:6:244