The experimental function signature is only available when
`GIT_EXPERIMENTAL_SHA256` is enabled.

`git_oid`s now have a type, and we require the oid type when creating
the object id from creation functions.

In preparation for SHA256 support, `GIT_OID_RAWSZ` and `GIT_OID_HEXSZ`
need to indicate that they're the size of _SHA1_ OIDs.

midx: do not verify the checksum on load

Though both are correct, this makes it clear that we're dealing with
the same value.

It's insufficient to only check if the offset high order bit is set, we
must also check to see if object_large_offsets are in use.

This bug is causing objects to appear missing because they can't be
found in the index.

This is something we only want to do during explicit verification rather than on
every load.

Verifying does not seem like a big deal when we're running with test workloads
but once your `multi-pack-index` reaches gigabytes, we spend more time hashing
this than doing any work.

A multi-pack index uses raw oid data, use a byte array to index
into them.

There was a missing check to ensure that the `off64_t` (which is a
signed value) didn't overflow when parsing it from the midx file. This
shouldn't have huge repercusions since the parsed value is immediately
validated afterwards, but then again, there is no such thing as "benign"
undefined behavior.

This change makes all the bitwise arithmetic happen with unsigned types
and is only casted to `off64_t` until the very end.

Thanks to Taotao Gu for finding and reporting this!