refscope: add ExcludeRefs for exact ref-name exclusion

RefScope.ExcludeRefs excludes exact ref names (whole-name match) from auto-discovery, alongside the existing prefix-based ExcludeRefPrefixes. Unlike a prefix, an exact entry does not match children — so a caller can reserve a directory-anchor ref like refs/heads/entire while still mirroring refs/heads/entire/foo (a prefix would also catch refs/heads/entirely). Threaded through RefScope -> internalbridge -> syncer.Config -> planner.PlanConfig; IsRefExcluded now takes both a prefix and an exact list.

Needed by entiredb's unmirrored-branches feature so the mirror worker can skip exactly the reserved anchor refs without dropping their mirrored children.