fix: block ref-qualified feature_branch names

[mekilis]

Summary

• The feature_branch guard blocked literal main/master but not ref-qualified shapes like refs/heads/main, which pass the character allowlist and reach git push --force. refs/* is now rejected.
• Same fix as feat: add OpenAPI-generated API client convoy-java#1 (flagged there by security review; applied here for guard parity).

Test plan

• Guard-only change; dispatch path unchanged for valid branch names

---

Note

Low Risk
Single guard clause in a dispatch-only CI path; no runtime or application behavior changes.

Overview
Tightens the workflow_dispatch feature_branch validation in sdk_generation.yaml so ref-qualified names cannot slip past the existing main/master block.

The case pattern now includes refs/*, rejecting inputs like refs/heads/main that satisfy the character allowlist but could still reach git push --force against the default branch. A short comment documents why refs/* is treated as invalid.

^{Reviewed by Cursor Bugbot for commit b557aee. Bugbot is set up for automated code reviews on this repo. Configure here.}