Use CollisionDetection SHA1 backend within libgit2

libgit2 supports SHA1 collision detection [0], which basically
identifies files that have distinctive sequences of bytes that show they
have been hand-crafted to defeat SHA1, and instead alters the SHA1
hashing algorithm to do something different for those bytestreams.  This
"hardens" the SHA1 implementation, and importantly for us, doesn't
introduce any extra dependencies such as libssl.

[0]: https://blog.github.com/2017-03-20-sha-1-collision-detection-on-github-com/

deps/libgit2.mk

@@ -37,7 +37,7 @@ LIBGIT2_OPTS += -DCURL_INCLUDE_DIRS=$(build_includedir) -DCURL_LIBRARIES="-L$(bu
 endif
 
 ifneq (,$(findstring $(OS),Linux FreeBSD))
-LIBGIT2_OPTS += -DUSE_HTTPS=ON -DHTTPS_BACKEND="mbedTLS" -DCMAKE_INSTALL_RPATH="\$$ORIGIN"
+LIBGIT2_OPTS += -DUSE_HTTPS="mbedTLS" -DSHA1_BACKEND="CollisionDetection" -DCMAKE_INSTALL_RPATH="\$$ORIGIN"
 endif
 
 LIBGIT2_SRC_PATH := $(SRCCACHE)/$(LIBGIT2_SRC_DIR)