This is pretty useful in avoiding races: I want to create a ref only if
it doesn't already exist.  I can't check first because of TOCTOU -- by
the time I finish the check, someone else might have already created
the ref.  And I can't take a lock because then I can't do the create,
since the create expects to take the lock.

The semantics are inspired by git update-ref, which allows an all-zero old
value to mean that the ref must not exist.