Extend Cartfile syntax to support pinning to arbitrary branches/tags/commits

#193, retargeted to `0.4-development`.

Resolves #100.
(Note that this only applies when you’re not binding symbols.)