Add RefScope.AllRefs to broaden mirroring beyond branches and tags

Introduce a third RefKindOther for refs/* namespaces outside refs/heads/ and refs/tags/ (notes, pulls, replace, custom). Validation accepts those mappings only when the new RefScope.AllRefs flag is set; without it the existing strict branch/tag flow stays loud about unsupported refs.

When AllRefs is set, BuildDesiredRefs picks up every refs/* on the source, RefPrefixes collapses to a single "refs/" so v2 ls-refs returns the broader set, and prune treats unmanaged other-kind target refs as delete candidates. Other-kind refs follow branch-style semantics (fast-forward / force) in PlanRef, and the existing relay paths fall through to the materialized push because their kind switches default to "unsupported", which is the right behavior for a first cut.

This wires the field through the public RefScope, ProbeRequest, internalbridge, syncer.Config, and the unstable client. CLI surface and best-effort failure handling come in follow-up commits.