Detect when git commit refs are unlikely to be SHAs

Currently, if you have a git ref which is not a SHA, such as

```yaml
- location:
git: https://github.com/commercialhaskell/stack
commit: master
```

Then it leads to non-reproducible builds, because you will just get the most recent version of the repo. Perhaps less expected, is that it will not attempt to update the repo, instead it will just use the version that you have. This is documented:

> Note: it is highly recommended that you only use SHA1 values for a Git or
> Mercurial commit. Other values may work, but they are not officially supported,
> and may result in unexpected behavior (namely, stack will not automatically
> pull to update to new versions). Another problem with this is that your build
> will not be deterministic, because when someone else tries to build the project
> they can get a different checkout of the package.

Since git dependencies can now be shared via extensible snapshots, it seems even more dangerous to have non SHA refs. Should warn about this, and perhaps refuse to share such packages.