upload-pack: use object pointer not copy of sha1 to keep track of has/needs.