ci/check-cherry-picks: never check older stable branches

This makes the job significantly faster when the commit can't be found
on master or staging directly. Before this change, the script would have
had to iterate through 20+ release branches before finding the latest
one. With lazy fetching for git enabled, this would take a few minutes.

(cherry picked from commit a9b718b79640e9c0ad4366391654fd4138248187)

ci/check-cherry-picks.sh

···
   for pattern in $PICKABLE_BRANCHES ; do
     set +f # re-enable pathname expansion
 
-    branches="$(git for-each-ref --format="%(refname)" "refs/remotes/${remote:-origin}/$pattern")"
+    # Reverse sorting by refname and taking one match only means we can only backport
+    # from unstable and the latest stable. That makes sense, because even right after
+    # branch-off, when we have two supported stable branches, we only ever want to cherry-pick
+    # **to** the older one, but never **from** it.
+    # This makes the job significantly faster in the case when commits can't be found,
+    # because it doesn't need to iterate through 20+ branches, which all need to be fetched.
+    branches="$(git for-each-ref --sort=-refname --format="%(refname)" \
+      "refs/remotes/${remote:-origin}/$pattern" | head -n1)"
 
     while read -r picked_branch ; do
       if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then