Git analysis: relax branch computation

Currently, our git commit enumeration relies on the commit hashes listed in the OSV record (as introduced/fixed/last_affected) to exist in git branches in the upstream repository:

- https://github.com/google/osv.dev/blob/a751ceb26522f093edf26c0ad167cfd0967716d9/osv/impact.py#L168
- https://github.com/google/osv.dev/blob/a751ceb26522f093edf26c0ad167cfd0967716d9/osv/impact.py#L172 (and similar in the same function).

This assumption doesn't hold in a number of cases. e.g. https://github.com/google/osv.dev/issues/2333 and https://github.com/google/osv.dev/issues/2375#issuecomment-2215478955 to name a few.

We need to relax this requirement to instead:
1. Consider the referenced introduced/fixed/last_affected commit position as its own logical "branch" if it's not part of any upstream branches.
2. Include all tag references that isn't already covered by a branch in the analysis. This is likely less important than 1, which would solve most of the problems we've seen.