projects need way to enforce pinned upstream dist-git/spec reference

[reubeno]

For a 'stable' project/distro, all the upstream references should be pinned to a specific date/time or (per-package) dist-git commit hash. This prevents inputs to the stable project build changing over time.

There also should be a mechanism to opt-out (or opt-in) of the upstream pinning for dev work, possibly a (project/distro-wide) parameter in the toml, and/or azldev cmdline param.

--
Imported on behalf of @ddstreet