Parse action doesn't validate commit hash

[cassidyjames]

What Happened

An app dev appears to have rewritten a release tag; #66. The parse and build actions happily succeeded even though the listed commit doesn't match the release's commit.

Expected Behavior

The parse action should check the commit of the release and fail if it doesn't match.

[danirabbit]

It seems like the dev rewrote history a bit and tagged their release to another commit after it was submitted

[cassidyjames]

Correct. But further runs of the parse action should have caught that the release tag and commit hash no longer matched, e.g. when merging main into the PR.

[btkostner]

Both the parse and manifest actions do nothing with git. That is handled by https://github.com/elementary/appcenter-reviews/blob/main/.github/workflows/review.yml#L68. We just need some bash-fu to fail if it's not correct here.