Protect against rewriting pushed commits

[rixx]

For 95% of cases, checking that a commit is not part of origin/<branch> (or maybe any <remote>/<branch>) is a good idea. Worth adding a flag to opt out of the protection, of course.

(Very tempting to also add a special specifier for unpushed commits for faster rewriting, but that's probably on the too lazy/too ambiguous side.)