On the authzperf branch: Make handling of "**" (any-var) match user's expectations. See test cases.
This fixes the calculation of recursive access rights. The pre-calculated information on the tree nodes must only cover the bottom-up view, i.e. what range of access rights has been defined anywhere in the sub-tree. Top-down application of inheritance must be restricted to the lookup - which already fully handles it. Hence, we only need finalize_tree instead of finalize_up_tree and finalize_down_tree.
The second change in here is that trailing any-var patterns will actually eclipse (hide / replace) any previous rule for the respective sub-tree. That is relevant for recursive right checks which don't operate on the repository node tree but only on the set of *potentially* applicable rules for that sub-tree. This implements the only easy-to-handle special case of a pattern replacing a set of other pattern rules.
* subversion/libsvn_repos/authz.c (limited_rights_t): Commentary reflects that these bottom-up only now. (trim_subnode_hash, trim_subnode_array, trim_tree): New functions implementing the any-var eclipses older rule principle.
(finalize_up_subnode_array, finalize_up_tree): Rename to ... (finalize_subnode_array, finalize_tree): ... this. No longer take the parent rights into account. (finalize_subnode_hash): New utility function factored out from finalize_tree. (finalize_up_subnode_array, finalize_up_tree): Remove.
(create_user_authz): Update caller. Invoke the new trim function, too.
* subversion/tests/libsvn_repos/repos-test.c (test_authz_recursive_override, test_authz_pattern_tests): New test cases. (test_funcs): Register new tests.