This brings support for untrusted regexp for 'only:refs:' when enabled via feature flag: alllow_unsafe_ruby_regexp. This is by default disabled, and should not be used in production
This makes ref validation to use always `UntrustedRegexp`. This also splits the existing RubySyntax into separate class.