fix: reject a bracketed host that is not an IPv6 address

[SashaMIT]

Parse("[:::]:5000/repo") returned a reference and a nil error. [:::::::]:5000/repo and [fd00123123123]:75050/repo did the same. The name regexp accepts any run of hex digits and colons inside the brackets. The grammar calls that an RFC 3986 IPv6 address, and none of those strings is one.

[::1]:5000/repo, [2001:db8::1]:5000/repo, and [2001:db8::]:5000/repo still parse. A port is still any run of digits, which is what the grammar spells out. The domain regexp stays a prefilter. DomainRegexp still matches [fd00123123123]:75050, and Parse now rejects it.

go test -count=1 -run 'TestReferenceParse/\[:::' failed on tip with missing expected error: invalid reference format and passes after the change. go test . passes. golangci-lint v2 reports no issues.

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.12%. Comparing base (6ccba5a) to head (3e6189a).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
reference.go	81.81%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #29      +/-   ##
==========================================
- Coverage   84.21%   84.12%   -0.09%     
==========================================
  Files           5        5              
  Lines         304      315      +11     
==========================================
+ Hits          256      265       +9     
- Misses         38       39       +1     
- Partials       10       11       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[milosgajdos]

This is breaking the build proper

[SashaMIT]

The package tests pass. go test ./... is ok on this branch.

The red job is golangci-lint v2.0 typechecking Go 1.27. It cannot load crypto/sha256 (export data version 4, the linter supports 2), and then every digest use shows up as undefined. The oncevalue PR failed that same test job in April. I have not changed the linter. Happy to bump it in this PR if you want.

[milosgajdos]

We have to bump min Go version here @thaJeztah -- it's wildly ancient.

That said, until we do, we need to figure out how to make things work with the current version.