Consider pinning non che-sample projects in devfile registry to specific commits

[JPinkney]

Is your enhancement related to a problem? Please describe.

After working on #15852 I think it might be wise to start pinning the projects referenced in the devfiles in the devfile registry to specific commits. As it stands it looks like many (if not all?) projects in the devfile registry just use master branch. Of course when they are che-samples we can create a stable branch and reference that in the devfile. However, for other upstream samples that aren't worked on by members of this community we end up having to play a cat and mouse game where master branch changes something and we now have to go into the devfile registry and adjust a task, etc. Although this means we would without a doubt eventually be behind master, we gain the ability to ensure that our devfiles are stable and that if a user wants to start a workspace with a devfile from the registry all tooling and tasks will be working all the time.

Describe the solution you'd like

I'd like us to pin devfiles to specific commits so that we won't run into issues like #15852

Describe alternatives you've considered

None

Additional context

[tsmaeder]

+1.

[tsmaeder]

I think for sample where release tags exist, that would be more customary. Otherwise commit hashes make sense.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.