Should refuse to write to existing, non-Bookkeeper-managed target branch

[krancour]

There is a nil pointer dereference that can occur here:

https://github.com/akuity/bookkeeper/blob/main/service.go#L156-L160

Here is the sequence of events for three different scenarios:

1. Target branch exists and has branch metadata -- no problem
2. Target branch does not exist -- Bookkeeper creates it and writes blank metadata -- no problem
3. Target branch exists and has no metadata -- PROBLEM

In the third case, the attempt to load branch metadata returns nil, which is the proximate cause of the nil pointer dereference.

However, there's something worse going on here...

This scenario is reflective of an attempt to write to an existing branch that was not previously managed by Bookkeeper.

That's a problem. We should detect this scenario and return an error indicating a refusal to write to the target branch.