DoS on wrong password

As discussed in upstream bug report saltstack/salt#38230 pygit2 tries to authenticate indefinite with wrong credentials instead of failing after two consecutive failures with same authentication token as specified by https://tools.ietf.org/html/rfc7235#section-3.1
Possible a libgit2 Bug if it's reproducable with other language bindings.

Testcase:

nginx dummy server configuration

This is just a stub configuration, no real repository needed

location ~ /git(/.*) {
        add_header "WWW-Authenticate" "Basic realm=\"Closed Areas\"" always;
        return 401;
    }

test client

#!/bin/python2.7

import pygit2

username = 'dummyUser'
password = 'dummyPassword'
credentials = pygit2.UserPass(username, password)
callbacks = pygit2.RemoteCallbacks(credentials)
pygit2.clone_repository("http://git.demo.local/git/test.git", "test.git", bare=True, callbacks=callbacks)

从使用 pygit2.UserPass、pygit2.RemoteCallbacks 和 pygit2.clone_repository 针对所提供 nginx 配置的 Python 测试用例开始。重现重复的身份验证尝试，并将行为与 RFC 7235 第 3.1 节进行比较。在使用相同身份验证令牌连续失败两次后 clone 失败，同时确认该行为是否特定于 pygit2 或 libgit2，即视为完成。