Fix git loader to pass ref to fetchGit

[3noch]

The new git loader uses builtins.fetchGit for private repos. Now that v0.5 actually marks repos private (whereas it this was always disabled before), we're getting more test coverage of this loader. We've found that it gets stuck when downloading a rev that it's never seen before and is also not in the history of the default branch. You end up getting an error like

fatal: not a tree object: 3f00db4a6e211d6e648f236c15eaf68c2dc8385e
error: program 'git' failed with exit code 128

It turns out that builtins.fetchGit does a shallow clone on the given ref and then searches for the given rev. So you must make sure that your ref contains the rev, and passing no ref assumes the default branch.

This fix adds a new git loader to fix this issue by passing branch as ref to builtins.fetchGit.

I have:

• Looked for lint in my changes with hlint . (lint found code you did not write can be left alone)
• Run the test suite: $(nix-build -A selftest --no-out-link)
• (Optional) Run CI tests locally: nix-build release.nix -A build.x86_64-linux --no-out-link (or x86_64-darwin on macOS)