Lock down polipo cookbook version

They don't tag, so use git sha.