Fix #7196, #5476

Fix for current `Pkg.checkout` issues.  This PR assumes that the desired upstream repo is named "origin", which seems to be what `Pkg.add` assumes.  

It might be safer to use `refs/remotes/origin`, in which case `Pkg.add` should also be updated.

cc: @StefanKarpinski @quinnj