view: the ref menu fails without pull request access, and the explorer keeps old refs #2073

Found in the review of #2057, which adds the experimental view. It does not block that PR; #2059 fixed the findings that did. Paths refer to #2059's head.

Problem

• The ref menu fails as a whole without access to pull requests. web/view/src/github.ts fetches branches, tags and pull requests with Promise.all. Listing pull requests needs the "Pull requests: read" permission, but the sign-in dialog asks only for "Contents: Read-only". For a private repository, the pull request request fails and takes branches and tags with it.
• The explorer keeps the first repository's refs. web/view/src/explorer.ts caches the refs with this.refs ??= and never resets them or its title when the page moves to another repository.

Proposed fix

• Use Promise.allSettled, show what loaded, and name the needed permissions in the dialog.
• Key the explorer's ref cache by owner, repository and token, or reset it on host.onState.