BUG: Use persistent versions in ExternalProject tags.

Named branches move arbitrarily.  Tags or sha's prevent local and dashboard
build from failing without any explicit change that explains why they fail.
If a specific version of TubeTK is checkout out, an persistent sha or tag
ensures that verisons of dependencies that work will also be available.

Change-Id: Ib39247f250afeeb8ed4418dc7ca01331a2ca008b