libutil: disallow implicit ref creations

448c7d50e1 was a bit over-eager and didn't
make the `ref(enable_shared_from_this &)` constructor explicit. this has
confused hydra maintainers, and is just generally bad practice since any
reference is allowed to implicitly convert, even if those references are
not associated with an active control block. we can't avoid this problem
entirely, but we can make what happens more explicit by ... well, making
the involved constructor explicit. enable_shared_from_this is statically
unsafe in principle and we really have to get rid of this nonsense soon.

Change-Id: I8b48ef4353e6301b61af3569083f42bc7379b0a4

lix/libexpr/eval-cache.cc

@@ -352,7 +352,7 @@ Value * EvalCache::getRootValue(EvalState & state)
 
 ref<AttrCursor> EvalCache::getRoot()
 {
-    return make_ref<AttrCursor>(*this, std::nullopt);
+    return make_ref<AttrCursor>(ref<EvalCache>(*this), std::nullopt);
 }
 
 AttrCursor::AttrCursor(

lix/libstore/binary-cache-store.cc

@@ -532,7 +532,7 @@ try {
 
 ref<FSAccessor> BinaryCacheStore::getFSAccessor()
 {
-    return make_ref<RemoteFSAccessor>(*this, config().localNarCache);
+    return make_ref<RemoteFSAccessor>(ref<Store>(*this), config().localNarCache);
 }
 
 kj::Promise<Result<void>>

lix/libstore/remote-store.cc

@@ -1022,7 +1022,7 @@ try {
 
 ref<FSAccessor> RemoteStore::getFSAccessor()
 {
-    return make_ref<RemoteFSAccessor>(*this);
+    return make_ref<RemoteFSAccessor>(ref<Store>(*this));
 }
 
 static Logger::Fields readFields(Source & from)

lix/libutil/ref.hh

@@ -39,7 +39,7 @@ public:
     }
 
     template<std::derived_from<std::enable_shared_from_this<T>> T2>
-    ref(T2 & r) : p(r.shared_from_this())
+    explicit ref(T2 & r) : p(r.shared_from_this())
     {
     }