[GHSA] GHSA-qgq7-7hm3-q39j (medium) — go-git: Malicious reference names may modify files outside the reference storage

GHSA-qgq7-7hm3-q39j Severity: medium CVE: CVE-2026-71557

go-git: Malicious reference names may modify files outside the reference storage

### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the repository's intended reference storage.

Loose references are stored under `.git/<reference-name>`. The reference name was previously used as a pat