build(nimble): pin viega/zippy to SHA, not unclear tag

[ee7]

Description

Previously, the pinning of this dependency was potentially confusing because:

• The upstream repo, guzba/zippy, has a v0.10.7 tag for a different state.

• One repo's tag includes the v prefix, and the other doesn't.

Pin to a SHA, like we do for con4m.

See:

• https://github.com/guzba/zippy/releases/tag/0.10.7
• https://github.com/viega/zippy/releases/tag/v0.10.7
• https://github.com/guzba/zippy/compare/0.10.7...viega:zippy:v0.10.7

Follow-up from https://github.com/crashappsec/chalk/issues/142#issuecomment-2029893033

Testing

Verify that this PR produces no functional change.