receive-pack: verify push options in cert