Stop panicking when CString conversion fails

I started this at #1295 and #1296 and then realized that there are a lot more places that should be adjusted, so filing to discuss first.

CheckoutBuilder::path(), ancestor_label(), our_label(), their_label()
TreeUpdateBuilder::remove(), upsert()
DescribeFormatOptions::dirty_suffix()
DescribeOptions::pattern()
DiffOptions::old_prefix(), new_prefix(), pathspec()
EmailCreateOptions::subject_prefix()
ObjectType::from_str()
MergeFileOptions::ancestor_label(), our_label(), their_label()
MergeFileInput::path()
ProxyOptions::url()
RebaseOptions::rewrite_notes_ref()
Refspec::dst_matches(), src_matches(), transform(), rtransform()
FetchOptions::custom_headers()
PushOptions::custom_headers(), remote_push_options()
RepositoryInitOptions::workdir_path(), description(), template_path(), initial_head(), origin_url()
StatusOptions::pathspec()
Transaction::lock_ref(), set_target(), set_symbolic_target(), set_reflog(), remove()
Tree::get_name_bytes()

Start by reviewing the conversion behavior in the listed builder, options, transaction, tree, and refspec methods, along with issues #1295 and #1296. The scope is to agree on consistent handling when CString conversion fails across all named entry points; completion should cover each listed method without panicking.