Stash pre-receive hook plugin for denying force pushes to specified branches. Has a feature to allow force pushes to a list of trusted users.