Unify git state detection mechanisms

[luhring]

Today we have two similar functions that try to get the current commit for the Melange configuration file (e.g. crane.yaml):

• detectCommit — used to populate the commit value of the APK's PKGINFO
• ConfigFileExternalRef — used to create a PURL for the distro package definition to be used in the SBOM

The latter implementation also has a brittle dependency on the configured remote being named origin, and if it's not, the PURL is silently withheld from the SBOM.

The commit claimed as the version of the melange config used for the build should be the same between (a) the APK's PKGINFO and (b) the APK's SBOM. So ideally they'd use the same implementation to arrive at this value.