remote-curl: pass ref SHA-1 to fetch-pack as well