git.allow_any_sha1_in_want=false does not block arbitrary object wants #77

Summary

Setting git.allow_any_sha1_in_want = false does not prevent clients from requesting arbitrary object IDs.

Current behavior

The configuration field exists, but upload-pack is initialized with arbitrary SHA-1 wants enabled unconditionally. The gix fetch path also accepts arbitrary wants without consulting the setting. As a result, changing the option to false has no effect.

Expected behavior

When the option is disabled, upload-pack should only accept wants reachable from advertised refs. Both the stock Git and gix serving paths should enforce the same policy.

Suggested implementation

Thread the configured value through upload-pack setup and the gix want validation path, and add protocol tests covering allowed and rejected wants for both values. Since the project is pre-1.0, remove the option instead if unrestricted wants are the only supported design.

Relevant code

• crates/walgit-config/src/lib.rs:572
• crates/walgit-git/src/lib.rs:636
• crates/walgit-git/src/lib.rs:3331