Prevent creating branches through the backdoor

Still not implemented for 5.x-1.0.

Ported from cvs.module. It's a bit different for Version Control API: instead of checking the branch names directly, we instead add them to the $operation['labels'] array (which was a minor todo item anyways!) so that higher-level write access checks like the Commit Restrictions module can catch this and abort the commit. Now we only need to verify that Commit Restrictions actually does that, to be checked with something similar like the example given in the above cvslog issue.

Tested; works.