Persist the exact commit SHAs used to build

[aleb]

When the manifest specifies modules to be built out of git branches, which are a moving target, it's not always clear what commits exactly have been used to build the modules.

I see --show-manifestcan be used to generate a complete manifest file:

flatpak-builder --show-manifest manifest.json

It would be good if --show-manifest can be used with a new --replace-branches flag to check each git module specifying a branch and replace that with a commit SHA. This way, the resulting file can be used to build AND kept for reference.

This way, developers can use the last known good manifest created by the nightly CI to build a working local sandbox for development.

Thank you!