VersionMap values should be git refs, not full URLs

[rd4398]

Summary

The current VersionMap implementation (src/fromager/versionmap.py) stores values as full download URLs (e.g. https://example.com/pkg-1.2.tar.gz), but the new-resolver-config proposal specifies that versionmap-git values should be git refs — commit SHAs or ref paths — used alongside a separate clone_url.

Proposal example (docs/proposals/new-resolver-config.md)

source:
  provider: versionmap-git
  clone_url: https://git.example/viking/viking.git
  build_sdist: pep517
  versionmap:
    '1.0': abad1dea
    '1.1': refs/tags/1.1

Here the values are git refs (abad1dea, refs/tags/1.1), not URLs.

Current behavior

VersionMapProvider in src/fromager/resolver.py wraps VersionMap and passes each value directly as a url to Candidate. The tests in tests/test_resolver.py confirm this — they use full URLs as values:

version_map = VersionMap({
    "1.2": "https://example.com/pkg-1.2.tar.gz",
    "1.3": "https://example.com/pkg-1.3.tar.gz",
})

What needs to change

Update VersionMap and VersionMapProvider so that the values represent git refs (commit IDs or tag refs) rather than full URLs, consistent with the versionmap-git provider design in the proposal. The clone_url should be a separate field on the provider, and the ref should be used to check out the correct commit after cloning.

Update existing tests to reflect the new value format.