add_tag() can now take a specific commit SHA to mark as a tag

Signed-off-by: Sam Xiao <sam.xiao@lookout.com>