Review types exposed by ReadOnly

[FintanH]

The ReadOnlyStorage trait exposes some git2 types which allow mutation to the store. For example, a &mut reference to a git2::Reference will allow the caller to delete that reference.

It's not really possible to completely stop someone from doing this since they can always drop down through the git2 API (or any other for that matter), however, if we provide types that prohibit these actions then we can encourage someone from not doing something like that :)