Add user ref operation validation example.

The following example blocks any update to any ref that starts with
'refs/heads/protected-' prefix if it is performed by user that has
no 'Administrate Server' capability.

Change-Id: If5373d238a4d30fc450a4114e6af51d6536ae91a
Signed-off-by: Jacek Centkowski <geminica.programs@gmail.com>