Use SHA for annotated tags

[liquidz]

Currently, antq uses SHA for deps on git, where the tag is an exact match.
But, for example, tools.build contains annotated tags, so there are two SHAs for a particular version.

$ git ls-remote --tags
...
2526f58294a24c1ff94e4ce33c24c19552f921f2        refs/tags/v0.7.5
34727f790d0b4d568fe3b5699ce6ebfcc1f55d39        refs/tags/v0.7.5^{}

So the current upgrading process will update SHA to 2526f58 instead of 34727f7.
This works, but it is preferable to handle annotated tags in antq too, because 34727f7 is handled on GitHub and in tools.gitlibs.

[liquidz]

Closed by #142