WIP: gitclone: refuse git checkout on a branch when allow-picked-versions is false

Because the we set allow-picked-versions to false in order to ensure build reproductibility, it makes sense to also enforce code checked out from git is checked out at a fixed revision