Allow to pin dependencies

[darosior]

The various scripts will at the moment always pull the master branch of each of the projects. This introduces a way to fetch a specific commit per project with minimal changes.

Specifying a specific commit for the project you use is useful for (at least):

• Pinning a known-working version: a user might not want to unexpectedly have to debug your build if for some reason the latest push on one of the upstream makes an incompatible change.
• Reproducible builds: it is very unlikely you'd keep having the same binaries if the toolchain you use is a moving target.

It might not be relevant for all project pulled in the scripts (for instance i'm not sure about darling)?

[darosior]

I wonder if it's not cleaner to pass a new argument to get_sources, the revision, and git checkout there instead of passing commit hashes as branches.