Mirror only branches and tags (#28)

* Mirror only branches and tags

Instead of blacklisting individual hidden ref namespaces, keep only
refs/heads/* and refs/tags/* before pushing. GitHub advertises additional
hidden refs (e.g. refs/pull/*, refs/github-services/*) that are pulled in by
`git clone --mirror`. Destinations such as GitLab, Bitbucket or Codeup reject
any ref outside heads/tags in their pre-receive hook, which declines the
entire mirror push (including refs/heads/main).

Whitelisting heads and tags fixes this for current and future GitHub hidden
namespaces without needing a new exclusion each time one is added.

* Add CI test for hidden ref filtering

Reproduces the mirror failure hermetically: a source repo seeded with
GitHub-style hidden refs (refs/pull/*, refs/github-services/*) plus a note is
mirrored to a bare destination whose pre-receive hook rejects anything outside
refs/heads/* and refs/tags/*, mimicking hosts like GitLab, Bitbucket or Codeup.

The test asserts the push succeeds and only the branch and tag arrive. A
blacklist regression would push the hidden refs, get declined by the hook and
fail the job.

* Set release version 1.3.0 in changelog