The context here is that this is the easiest way to ensure that we get reproducible builds, given that projects sometimes silently repoint tags to different commit refs.

By disallowing this up front (via a boulder lint pass), we will never run into a situation where we have this happen to us in the first place.

Bonus points for ensuring the associated error message reads well, so packagers don't end up complaining/asking why boulder doesn't support tags.