[Prachi194agrawal]

Related to #2367

Some advisory commit references do not belong to a branch in the referenced repository. This change keeps those commits and their advisory links while flagging their branch reachability for review.

The collect_ref_fix_commits_v2 pipeline now checks collected PackageCommitPatch records and stores one of three statuses: reachable, unreachable, or unknown. Incomplete clones and failed checks produce unknown. Unreachable commits are highlighted on the advisory commit details page and included in pipeline logs for upstream review.

The check creates one temporary bare clone per repository per run, with a five-minute timeout. The status reflects the branches observed during the latest check. This PR records the result locally; reporting commits upstream remains a separate step.

A migration adds the reachability field, with unknown as the default for existing records. The changes also add documentation and regression tests using local Git repositories.

Testing

venv/bin/python -m pytest \
  vulnerabilities/tests/pipelines/v2_improvers/test_reference_collect_commits_v2.py \
  vulnerabilities/tests/test_commit_code.py \
  --reuse-db -q

Result: 22 passed, 5 warnings.