setup: track remote repositories properly

The initial clone should be done with "--mirror" to enable tracking of
all remote refs. Also subsequent git fetch updates should use --prune.
Always update the remote URL before fetching in case the location changes.

Reported-by: Carlos Chinea <carlos.chinea@nsn.com>
setup: verify the git hash

Verify the git hash.