fix(webhook): deliver create events for tag pushes

[majorissuerep]

Summary

Fixes #38438.

Create-only webhooks stopped receiving tag create deliveries when a branch-oriented branch_filter (e.g. master / main) was set. That came from #35567 applying the branch filter to tag create/delete payloads, not only to tag push payloads.

Also, tag CreateRef was nested under a successful GetCommit, so a missing/unreadable peeled commit dropped the create event entirely even though the tag ref was created.

Changes

• Branch filter applies to push events and branch create/delete only
• Tag push events still respect branch filters (keeps Tag creation/deletion incorrectly triggers Push webhook (should only emit Create/Delete event) #35449 / fix(webhook): prevent tag events from bypassing branch filters targets #35449 #35567)
• Emit CreateRef for new tags independently of GetCommit
• Unit + integration tests for create-only tag push with a branch filter

Test plan

• go test ./services/webhook/ ./services/repository/
• make test-integration#Test_WebhookCreateTagViaGitPush
• make test-integration#Test_WebhookCreateTagViaAPI
• make test-integration#Test_WebhookCreate (branch create regression)
• Manual scenario matching the report:
  1. Webhook: custom events → Create only
  2. Branch filter: master (branch-oriented)
  3. git tag webhook-create-tag-38438 && git push origin refs/tags/webhook-create-tag-38438
  4. Delivery arrives with X-Gitea-Event: create, ref_type=tag

Proof (local)

• Unit: PASS (services/webhook, services/repository)
• Integration create-only tag push with filter master: PASS
• Integration API tag create: PASS
• Integration branch create: PASS

AI assistance used for implementation and tests; changes reviewed and exercised locally via the commands above.

[majorissuerep]

#38438 updated — tag create deliveries restored under branch-oriented filters; CreateRef no longer gated on GetCommit.

Assisted-by: Hermes:glm-5.2