Make possible to spacify plugin version to use by the SHA, not only by the plugin version

Background

We would like to specify the exact plugin version used in our projects (tag with sha commit)

Task description

Now plugins simply have a numbered version:

- origin: pip
  package-name: buildstream-external
  elements:
    flatpak_image: 0
    flatpak_repo: 0

This give the plugin author all the responsibility of knowing if the change breaks the build and if they have to change the version

I'd like to not rely on that and control exactly what is being used in my project.conf directly

Acceptance Criteria

• It's possible to specify the exact version used, so a change in the sha will trigger a rebuild