lock-down git gem dependencies

We've hit numerous issues related to, due to dependencies changing quite rapidly. I should be able to checkout an old
version of cc_ng and it should point to the correct version of vcap_common.git and cf_message_bus.git it used at that time. Just using HEAD is unmanageable.