save-push-signatures: use refs/meta/push-certs instead of refs/push-certs

Historically, this hook put the certs in a ref named refs/push-certs.

However, git does *NOT* replicate single-level refs, and this meant that
gitolite mirroring did not replicate the push-certs!

Trying to push them explicitly causes this error:
```
remote: error: refusing to create funny ref 'refs/push-certs' remotely
```

Upstream Git has good reasons as to why not to replicate single-level
refs: https://lore.kernel.org/git/robbat2-20211115T063838-612792475Z@orbis-terrarum.net/

As a good-enough solution, use the namespace of meta/ for the refs.
This is already used in other systems:
- kernel.org refs/meta/cgit
- gerrit refs/meta/config
- GitBlit reflog: refs/meta/gitblit https://www.gitblit.com/administration.html#H12
- cc-utils refs/meta/ci
- JGit refs/meta/push-certs https://www.ibm.com/docs/en/radfws/9.6.1?topic=SSRTLW_9.6.1/org.eclipse.egit.doc/help/JGit/New_and_Noteworthy/4.1/4.1.htm

To migrate from old to new, for each repo, you must explicitly run:
git update-ref refs/meta/push-certs refs/push-certs

Then the hook will populate both refs.

You can remove the old ref after that:
git update-ref -d refs/push-certs

Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>

0 files changed, 0 insertions, 0 deletions