This commit tightens up the repo validation to exclude repos that don't
have any usable tags, unless the reference URL is obviously a commit.

The primary benefit here is that useless repos don't cause CVEs to be
in-scope for attempting conversion that shouldn't, while not
disregarding CVEs that have a potential fix commit as a reference, but a
repo that is otherwise useless for version-to-commit mapping.

In other words, it improves the overall conversion metrics by firming up
the denominator some more.

Last staging run against 2025 NVD data:

```
nvdcve-2.0-2025.json Metrics: {TotalCVEs:2870 CVEsForApplications:205 CVEsForKnownRepos:420 OSVRecordsGenerated:188 Outcomes:map[]} 
```

Local regression test:

```
nvdcve-2.0-2025.json Metrics: {TotalCVEs:2876 CVEsForApplications:205 CVEsForKnownRepos:302 OSVRecordsGenerated:189 Outcomes:map[]}
```

This change reduces the CVEs in scope by 118, while increasing records
converted by 1. (There _are_ 6 more CVEs in the latest NVD snapshot)