Agent does not verify requested commit-ish is in requested branch

Currently, if you manually trigger a build, specifying both a branch and a commit-ish, the Agent treats the specified commit-ish as though it were in the specified branch.

In cases where you require specific things to happen on specific branches (i.e. deploy from master), this can cause issues.

A workaround for now is to implement a check in your own build scripts;

```bash
if ! git branch -r --contains "${BUILDKITE_COMMIT}" | grep -q "origin/${BUILDKITE_BRANCH}" 2> /dev/null; then
echo "The commit SHA ${BUILDKITE_COMMIT} was not found in ${BUILDKITE_BRANCH}. Exitting..."
exit 1
fi
```

(thanks to Jacob from Envato for investigation of this issue)

No file or test is named. Trace the Go code handling manually triggered builds and the branch/commit inputs, then reproduce a case where the requested commit is outside the requested branch. Done means the Agent detects and rejects that mismatch rather than proceeding.

Written by the indexing model from the issue text.