`cargo_universe`: Incorrect handling of `git` dependencies with `branch = "main"`

I have a project with a cargo dependency of the form

`a = { git = "...", branch = "main"}`
(the branch parameter is necessary because `rules_rust` assumes that the default branch of the repo is called main).
`Cargo.lock` contains
```
[[package]]
name = "a"
version = "0.2.0"
source = "git+...?branch=main#2da00986c01e979838b4a4c4a82dcc74a8df310a"
```

which I assume pins this package at that given commit, until the lockfile is updated again.
However, `Cargo.bazel.lock` only contains
```json
"Git": {
"remote": "https://github.com/github/codeql.git",
"commitish": {
"Branch": "main"
},
```
which then in turn creates a `new_git_repository` rule that clones the `main` branch directly, without any commit pinning. That breaks build hermeticity, and potentially builds different code than cargo would.