Extend Cartfile syntax to support pinning to arbitrary branches/tags/commits

#193, retargeted to `0.4-development`.

Resolves #100.
…or branch name? Or are those resolved to SHAs?