refs: reject ref updates while GIT_QUARANTINE_PATH is set