receive-pack: check object type of sha1 before using them as commits