Should we prevent adding packages to CHaP from non-master branches

For the sake of reproducible builds we probably want to avoid uploading to CHaP from ephemeral PR branches and probably also non-`master` branches.

In `db-sync` we have a check for `source-repository-package` git hashes [here](https://github.com/input-output-hk/cardano-db-sync/blob/master/.github/bin/check-git-dependencies).