Separate module for the concern of protecting `refs/rad`. Note that this also fixes a bug, as previously all refs *starting with* `refs/rad`, such as `refs/radieschen` were protected.