get_sha1(): fix error status regression

In finish_object_disambiguation(), if the candidate hasn't been
checked, there are two cases:

- It is the first and only object that match the prefix; or
- It replaced another object that matched the prefix but that
object did not satisfy ds->fn() callback.

And the former case we set ds->candidate_ok to true without doing
anything else, while for the latter we check the candidate, which
may set ds->candidate_ok to false.

At this point in the code, ds->candidate_ok can be false only if
this last-round check found that the candidate does not pass the
check, because the state after update_candidates() returns cannot
satisfy

!ds->ambiguous && ds->candidate_exists && ds->candidate_checked

and !ds->canidate_ok at the same time.

Hence, when we execute this "return", we know we have seen more than
one object that match the prefix (and none of them satisfied ds->fn),
meaning that we should say "the short name is ambiguous", not "there
is no object that matches the prefix".

Noticed by Jeff King.

Signed-off-by: Junio C Hamano <gitster@pobox.com>