refs: fix leak on successful update

Free the old ref even on success.
refs: add tests for conditional updates
refdb: add conditional symbolic updates

Add a parameter to the backend to allow checking for the old symbolic
target.