We are seeing a lot of rescued `Deployment::StatusUpdateError`s caused
by the late validation of the `ref` attribute on `Deployment`. We don't
want to remove that error capture, because it could also help detect
real problems.

We can, however, reduce the noise in our monitoring by performing the
validation early in the API. The error structure is preserved; the only
difference is that now we don't create the environment until after
validating the ref, so in case the user is both unauthorized to deploy
the environment, _and_ the ref is invalid, then we will now return a 400
bad request instead of a 403 forbidden. This is hardly a notable change,
but it is a user facing change nonetheless, hence the changelog entry.

Changelog: changed