resolve_ref(): also treat a too-long SHA1 as invalid