refs: plug strbuf leak in lock_ref_sha1_basic()