Avoid reinstalling env templates if Git source has not changed

[itowlson]

Fixes #3672.

The adopted fix is to record against each template the repo and tag that it was installed from, assume that tags and branches are immutable, and update only if the actual tag or branch listed in the env file has changed from the one used for installation.

But: two considerations:

1. This will result in missed updates if the env owner moves a tag or branch in their templates repo. For this to work, env owners have to consider refs immutable, and if they want to change their templates, they have to update their env with a new tag. I am not sure if this is a safe assumption. We could have a Plan B to re-fetch periodically, but either this kick in too often (and Thorsten would remain frustrated), or it would be too infrequent to be useful. Feedback welcome.

2. This does not address the delay to re-snapshot the environment, which happens if the environment is unversioned and our snapshot is more than 1 hour old (basically if no unversioned env has been used in the last hour). This is trickier because we can have absolutely no way to tell if the upstream has changed, without a network round-trip. We could increase the recency window to reduce the incidence of these delays, but again that just makes it more and more likely that a user will hit the window. Although we do have the spin targets update command to mitigate that, so maybe it would be okay.

So: feedback and discussion first, so we don't do the wrong thing; but at the same time, it would be nice to get any fix we are happy with into 4.1. So no mixed messages then.

(cc @ThorstenHans who flagged the original issue)