expire_reflog(): extract two policy-related functions