builtin/receive-pack: avoid hard-coded constants for push certs