Include git hash in package lock comment for unversioned packages

[Astiolo]

Sometimes it's nice to have things building the latest version of something, while still being able to record the state it was in at the time.

I think this can be solved by including a git hash in the cpm-package-lock.cmake file in the build directory, so when archiving versions of the output, you can include that with it to know exactly what state the packages were in at the time it was built.

[TheLartians]

Hey Astiolo, thanks for the issue! I agree that it makes a lot of sense to track the current commit hash in the package lock. This would also be a step towards a more modern package management approach (#99) and allow automatic updates etc in the future.

[CraigHutchinson]

💯 should be doing this for the cpm-update-package-lock if it is viable. Currently un-versioned targets are added as 'commented out' un-versioned dependencies which serves no useful purpose .. other than to simplify manually set the GIT_TAG to a SHA!

Also 'unversioned'... maybe should be non-versioned?

[CraigHutchinson]

I have just found CPM_INCLUDE_ALL_IN_PACKAGE_LOCK which disabled the (unversioned) commenting.
😢 This doesn't resolve the GIT_TAG to a specific SHA reference (as per Git Submodule behavior would) and includes the Branch on which the package is updated from so doesn't help on its own!
🐞 ++ There may be a bug here in that CPM_ARGS_SOURCE_DIR is checked after this flag, will need to discern if this is worth of a new issue:

CPM.cmake/cmake/CPM.cmake

Lines 756 to 762 in 63d0de7

	if((CPM_ARGS_VERSION AND NOT CPM_ARGS_SOURCE_DIR) OR CPM_INCLUDE_ALL_IN_PACKAGE_LOCK)
	cpm_add_to_package_lock(${CPM_ARGS_NAME} "${ARGN}")
	elseif(CPM_ARGS_SOURCE_DIR)
	cpm_add_comment_to_package_lock(${CPM_ARGS_NAME} "local directory")
	else()
	cpm_add_comment_to_package_lock(${CPM_ARGS_NAME} "${ARGN}")
	endif()

[TheLartians]

There may be a bug here in that CPM_ARGS_SOURCE_DIR is checked after this flag, will need to discern if this is worth of a new issue

I think the original reasoning was that SOURCE_DIR would likely not be system-independent, which a package-lock optimally would be, so it was omitted here. However especially in the context of CPM_INCLUDE_ALL_IN_PACKAGE_LOCK I see how it would be still expected here.