Commit tag enumeration: better detection of relevant branch heads

[oliverchang]

Currently, our version tag enumeration is based on looking through available upstream branches:

osv.dev/osv/impact.py

Line 143 in c8d6717

branches.extend(_branches_with_commit(repo, fix_commit))

However, this breaks when the upstream repo deletes branches over time (e.g. CPython per #1552). In these cases, it's possible tag references are still around that point to the various branch heads that we actually need to examine. We should include these in our analysis for more complete results.