Fix 404s downloading latest build artifacts

Previously ArtifactsController#latest_succeeded might return 404s even though ArtifactsController#download would successfully return an artifact. For example, this could happen when:

1. A new commit was merged to master.
2. A user attempts to download the artifact for master before the pipeline for master finishes, or the pipeline fails altogether.

To fix this problem, we fallback to looking up a successful pipelines by ref name if one doesn't exist for the SHA.

This solves the scenario described in #216055 (comment 346425733).

Closes #216055 (closed)