Extend Cartfile syntax to support pinning to arbitrary branches/tags/commits

#193, retargeted to `0.4-development`.

Resolves #100.
Me neither. I'll do that!