Extend Cartfile syntax to support pinning to arbitrary branches/tags/commits

#193, retargeted to `0.4-development`.

Resolves #100.
A branch name would technically work here without any changes, but we don't offer any supported way to do that. A `PinnedVersion` should always be a constant object, and reflects the contents of a `Cartfile.lock` (possibly one not written yet).