ref_transaction_update(): check refname_is_safe() at a minimum