make build-debs.sh Git-aware

[cfm]

2. Can we print the commit sha1/tag we are building from?
3. (bonus points) Can we verify said sha1/tag is signed? But in some optional way so if you're doing local test builds it just prints e.g. "WARNING: building from unsigned commit/tag" or something.

[...] then I think building packages would be 1) clone repo 2) checkout commit/tag 3) make build-debs and nothing else.

Originally posted by @legoktm in #6787 (review)

• Depends on build(build-debs*): log all output via script #6787