Upgrade go-git to v6.0.0-alpha.2

Closes the credential-leak advisory tracked as CVE-2026-41506 (GHSA-3xc5-wrhm-f963 / Dependabot alert #1). Our smart-HTTP path already used Go's stdlib http.Client directly, which strips the Authorization header on cross-host redirects since 1.8 — but upgrading clears the alert and pulls in the upstream http.followRedirects controls.

Alpha.2 is a major rewrite of plumbing/transport. Translation:

• *transport.Endpoint (struct) → *url.URL throughout. Field accesses (.Scheme, .Host, .Path, .User, .Hostname()) are unchanged.
• transport.NewEndpoint → transport.ParseURL.
• transport.AuthMethod (interface) is gone. Defined our own auth.Method and gitproto.AuthMethod with a single Authorizer(*http.Request) error method, satisfied by *transporthttp.BasicAuth and *transporthttp.TokenAuth (whose SetAuth methods were renamed to Authorizer).
• transport.Service (typed) → string constants. Function parameters take string.
• transporthttp.NewTransport(*TransportOptions) → NewTransport(Options) (value, not pointer).
• transport.AdvertiseReferences → transport.AdvertiseRefs.
• transport.UploadPackOptions → transport.UploadPackRequest; transport.ReceivePackOptions → transport.ReceivePackRequest.
• transport.Register / transport.Get were removed. The TestMain shims in syncer/integration_test.go and cmd/git-sync/main_test.go registered a custom HTTP transport for go-git's transport registry, but our code never goes through that registry — it hits the network through gitproto's own http.Client. Dropped both shims as dead code.

Also dropped the now-unused Conn.Transport field; nothing in git-sync read it.

Updated .golangci.yaml ireturn allowlist to permit the new auth.Method interface where the previous transport.AuthMethod allowance lived.