pygitweb,auth: drop write_branch permission for write_ref, and assume we want a whitelist if any write_ref permissions (even `[]`) are granted