TODO item: Include hashes in lock file

[cquinn]

When we locate the tag/version of a commit that we want during update, we should also record its commit hash in the lock file. We can then verify this when we fetch.

The Golang module system does this to avoid surprises caused by people moving tags around out from under people and quietly breaking builds.