Extend Cartfile syntax to support pinning to arbitrary branches/tags/commits

#193, retargeted to `0.4-development`.

Resolves #100.
:+1: Gotcha.