Release security: make it impossible to clobber builddirs which have the "release prefix"

I think it's reasonable to always return 200 OK -- as long as that's documented.  And that'd probably be the simplest in terms of DB access.  I wonder, too, if there's legitimate reasons to put in clobber requests for branches that haven't been built yet (and thus aren't in the DB).  @bhearsum?