Always pin specific git refs when building an image

If we don't we e.g. build the "master" ref, which will never update,
because podman caches the layer. Even if we rebuild with pinning,
another rebuild with the default "master" ref will revive the outdated cache entry and revert
to the old state, so the only way to actually update the image would be
to rebuild with --no-cache or by removing the image.

Looking up the git-refs on every build is of course slightly slower, but
shouldn't pose a problem.