remote-curl: make refs_url a strbuf