running stable more than once can result in merge conflicts which results in bad deps

[aturley]

Summary

If one of your dependencies points to a git tag/commit rather than master then running stable a second time can result in merge conflicts which can then cause the checkout of the branch to fail, leaving the .deps folder in a bad state.

Steps to Reproduce

1. Create a bundle.json file that uses a tag as the version. I'm using this:

{
"deps": [
  {
    "type": "local",
    "local-path": "../../lib"
  },
  {
    "type": "local",
    "local-path": "lib"
  },
  {
    "type": "local",
    "local-path": "../../go_api/pony"
  },
  {
    "type": "github",
    "repo": "WallarooLabs/pony-kafka",
    "tag": "ee70576"
  }
]
}

2. Run stable fetch twice.

Expected Behavior

Stable fetches the correct version of the library (pony-kafka in the case of the example above).

Actual Behavior

There is a merge conflict when pulling in the repo and so the git checkout command fails, leaving the .deps directory in a bad state.

Notes

I talked to @SeanTAllen and @jemc about it and we think the right thing to do for now is to call git -C [root] fetch instead of git -C [root] pull [url] (here)[https://github.com/ponylang/pony-stable/blob/master/stable/dep.pony#L54]. There's probably a more efficient way to do this in the future, but for now that's probably the best solution.