When Source-url points to a .git URL without /tree/<ref> or /commit/<sha>,
git_to_tarball just cloned and packed HEAD. If upstream HEAD had moved past
the spec Version, the resulting tarball contained sources from a different
release than the spec claimed (observed in hddfancontrol 2.1.0-alt1, which
shipped 2.1.1 sources because HEAD was already at 2.1.1 when packaged).

Now if no explicit checkout is given via URL, try to checkout 'v$VERSION'
or '$VERSION' tag and fail loudly if neither exists. To get a HEAD
snapshot intentionally, pass HEAD as the version (rpmgs already supports
this) or use # Source-url: ...git/tree/<ref>.

Also init submodules after checkout so the packed tree reflects the tag.