upload-pack: tighten request validation.

upload-pack: tighten request validation.

This makes sure what the other end asks for are among what we
offered to give them.  Otherwise we would end up running
git-rev-list with 20-byte nonsense, only to find it either die
(because the object was not found) or waste time (because we
ended up serving that phony 'client').

Also avoid wasting needs_sha1 pool to record duplicates, and
detect cloning requests better.

[this used to be on top of Johannes fetch-pack enhancements,
 which we are rewinding it for further testing for now, so
 the commit is rebased.]

Signed-off-by: Junio C Hamano <junkio@cox.net>