Add a check for tagged commits

[vashirov]

Issue Description
Release on GitHub can be created from a tag that points to a branch-less commit.
For example, releases starting from 2.4.1 are affected by this:

$ for i in $(seq 0 5); do git checkout 389-ds-base-2.4.$i; git branch -a --contains $(git rev-parse HEAD); done
Previous HEAD position was 3db81913e Bump version to 2.3.0
HEAD is now at 87efeb29a Bump version to 2.4.0
* (HEAD detached at 389-ds-base-2.4.0)
  main
  remotes/origin/389-ds-base-2.4
  remotes/origin/389-ds-base-2.5
  remotes/origin/HEAD -> origin/main
  remotes/origin/main
Previous HEAD position was 87efeb29a Bump version to 2.4.0
HEAD is now at 0906b610f Bump version to 2.4.1
* (HEAD detached at 389-ds-base-2.4.1)
Previous HEAD position was 0906b610f Bump version to 2.4.1
HEAD is now at 0dbf7d2ac Bump version to 2.4.2
* (HEAD detached at 389-ds-base-2.4.2)
Previous HEAD position was 0dbf7d2ac Bump version to 2.4.2
HEAD is now at e2581ae17 Bump version to 2.4.3
* (HEAD detached at 389-ds-base-2.4.3)
Previous HEAD position was e2581ae17 Bump version to 2.4.3
HEAD is now at 2cb07156d Bump version to 2.4.4
* (HEAD detached at 389-ds-base-2.4.4)
Previous HEAD position was 2cb07156d Bump version to 2.4.4
HEAD is now at 33c0e0115 Bump version to 2.4.5
* (HEAD detached at 389-ds-base-2.4.5)

I'm not sure how we end up with 2 "Bump version" commits where one is tagged, and another one is in the branch but not tagged. At least we should ensure that our releases point to the right commit in the branch.

[vashirov]

e2d5cf3..35d473f 389-ds-base-1.4.3 -> 389-ds-base-1.4.3
c68add0..ed0c0fe 389-ds-base-2.0 -> 389-ds-base-2.0
e996550..b43184b 389-ds-base-2.1 -> 389-ds-base-2.1
51f9ace..879cfd0 389-ds-base-2.2 -> 389-ds-base-2.2
e10252a..5016907 389-ds-base-2.3 -> 389-ds-base-2.3
7bdaec0..a7dda32 389-ds-base-2.4 -> 389-ds-base-2.4
13f5a6a..651d44f 389-ds-base-2.5 -> 389-ds-base-2.5