Harden git checkout calls

[eric-wieser]

By putting a -- after the sha, we ensure that git treats it as a ref and not a filename.