Add pre-commit hook which protects ref paths from non-FF updates or deletes unless the user is a member of an authorized team

This script is derived from groovy/blockpush.groovy