[#56945538] Use tags/branches for ClamAV/AppArmor

To make it clear why we've fixed on a specific revision. The commit refs
will be preserved in the `Puppetfile.lock`.