DoS on wrong password

As discussed in upstream bug report saltstack/salt#38230 pygit2 tries to authenticate indefinite with wrong credentials instead of failing after two consecutive failures with same authentication token as specified by https://tools.ietf.org/html/rfc7235#section-3.1
Possible a libgit2 Bug if it's reproducable with other language bindings.

Testcase:

nginx dummy server configuration

This is just a stub configuration, no real repository needed

location ~ /git(/.*) {
        add_header "WWW-Authenticate" "Basic realm=\"Closed Areas\"" always;
        return 401;
    }

test client

#!/bin/python2.7

import pygit2

username = 'dummyUser'
password = 'dummyPassword'
credentials = pygit2.UserPass(username, password)
callbacks = pygit2.RemoteCallbacks(credentials)
pygit2.clone_repository("http://git.demo.local/git/test.git", "test.git", bare=True, callbacks=callbacks)

Comienza con el caso de prueba de Python usando pygit2.UserPass, pygit2.RemoteCallbacks y pygit2.clone_repository contra la configuración de nginx proporcionada. Reproduce los intentos de autenticación repetidos y compara el comportamiento con RFC 7235 sección 3.1. Se considera terminado cuando el clonado falla después de dos fallos consecutivos con el mismo token de autenticación, y se confirma si el comportamiento es específico de pygit2 o de libgit2.