[WIP] Restrict which refs can be the default branch

We currently consider anything to be capable of being the default branch, including notes. We should only let the default branch be a branch, i.e. a ref living in `refs/heads/`.