Implements pinning extensions to release tag or commitish. Fixes #5067
Usage is same as specified by @vilmibm

$ gh extension install dlvhdr/gh-prs --pin v2.0.1
✓ Installed extension dlvhdr/gh-prs
✓ Pinned extension at v2.0.1
$ gh extension install mattn/gh-ost
<git noise>
✓ Installed extension mattn/gh-ost --pin 6e6f935
✓ Pinned extension at 6e6f935
$ gh extension list
gh ost               mattn/gh-ost                  6e6f935
gh prs               dlvhdr/gh-prs                 v2.0.1

For binary extensions the pin must be a release tag. It was simplest to add a Pinned field to the manifest.yml.
For git extensions the pin can be any commit ref; the extension is then pinned to the commit SHA. Implemented as a "pin file" in the extension's installation directory.

Right now upgrade --force will not override the pin.

Todo

• install
• list
• upgrade
• --force
• tests