fix: make checkout expected-commit bump less greedy

[bentasker]

Melange Pull Request Template

Prior to this commit, bumps updated expected-commit for any git checkout node who's tag attribute matched the regular expression \${{vars\..+}} (i.e. anything which used a variable).

This made the logic very greedy, clobbering values for unrelated checkouts (for example here)

We only want bumps to update those where tag matches either package.version or vars.mangled-package-version.

Currently we use the following vars in tag attributes:

ben@cosmos:~/Repos/os$ grep -h 'tag: ${' *.yaml | grep -v 'package\.version' | cut -d: -f2 | sort | uniq
 ${{vars.docker-machine-tag}}
 ${{vars.exporter-tag}}
 ${{vars.mangled-package-version}}

It also adds a check to ensure that expected-commit does not contain a variable (i.e. ${{) before overwriting it's value

[powersj]

@imjasonh @luhring - thoughts on this PR and who I should poke? This seems to keep coming up and more of our PRs would land if this were fixed up.