Fixes T5839. If a repository has been force pushed and garbage collected, we might have a ref cursor in the database which still points at the old commit (which no longer exists).

We'll then run a command like git log <new hash> --not <old hash> to figure out which commits are newly pushed, and this will bomb out because <old hash> is invalid.

Instead, validate all the <old hash> values before we try to make use of them.

• Forced a repository into a bad state by mucking with the datbase, generating a reproducible failure similar to the one in T5839.
• Applied patch.
• bin/repository update <callsign> --trace filtered the bad commit and put the repository into the right state.
• Saw new commits recognized correctly.
• Ran bin/repository update <callsign> for a Mercurial and SVN repo as a sanity check.