Bound what one repository and one account can cost

Bound what one repository and one account can cost

A repository had no quotas. A contributor could add branches in their own
namespace without limit, any writer could add issues and comments, a
maintainer could add tags, and every page that listed or parsed them grew
with the count. The instance's only answer was an admin deleting things
by hand.

Repository quotas now run in pre-receive, so a refused push moves no
refs, and they describe the repository the push would leave rather than
the one it found:

  repo_max_refs              branches and tags, counted with the refs the
                             push creates and deletes
  repo_max_metadata_entries  documents on the metadata branch: issues,
                             requests, comments, approvals, runs, releases
  repo_max_metadata_bytes    their total size
  repo_max_bytes             git objects on disk; a repository already
                             over it refuses further pushes, so growth is
                             the cap plus one permitted push
  repo_max_lfs_bytes         LFS objects, logs and artifacts, enforced on
                             the upload where the bytes arrive, with 413

The values reach the hook the same way the blob limit does: from the
instance config through the SSH server's environment, so a quota is one
setting rather than a second policy.

Browser writes are budgeted per account (`account_writes_per_hour`, 300).
The limiter is keyed by the account rather than the address, because the
account is what a write is attributed to; a person discussing never
reaches it.

Reads that a repository's own writers control are capped: for-each-ref
listings (branches, tags) return at most 500, while the quota check uses
a count that sees all of them. Activity feeds and state changes were
already bounded.

Open registration's baseline is unchanged (off, role none) and its role
is now restricted to none, read or contribute: a stranger who typed a
name must not be able to move a shared branch or approve a review.

Tests: refs (a new ref is counted, moving one is not), metadata entries
and bytes (a tree with two issues refuses at one, and passes at a
generous limit), repository size, and the LFS quota against a real store;
the transfer refuses a 413 upload over the object cap; the account write
budget; and the registration role refusal.