This release fixes an issue where AdvertiseRefsHook was not called for
git-upload-pack in protocol v0 stateless transports, meaning that
wants aren't validated and a user can fetch anything that is pointed
to by any ref (using fetch-by-sha1), as long as they can guess the
object name.
Bug: Issue 10262
Change-Id: I1018c6fcb5cd4e34d2b106929db3a8238f45cda0