R1:d2e9aee16d1a

Reject dangerous changes in Git repositories by default

Summary: Ref T4189. This adds a per-repository "dangerous changes" flag, which defaults to off. This flag must be enabled to do non-appending branch mutation (delete branches / rewrite history).

Test Plan:
With flag on and off, performed various safe and dangerous pushes.

>>> orbital ~/repos/POEMS $ git push origin :blarp
remote: +---------------------------------------------------------------+
remote: | * * * PUSH REJECTED BY EVIL…