Enforce that GitCommit must be a *full* commit hash

[tianon]

I thought this was already the behavior, but I guess it was relaxed because previous iterations of this validation had to apply to the older format where we'd been less meticulous about enforcing this. Since those are all gone now, we can safely update the validation to enforce that commit hashes must be fully qualified.

[tianon]

Some validation against https://github.com/docker-library/official-images:

$ git log -1 --oneline --no-decorate
bb7a6a131 Merge pull request #17351 from yaooqinn/patch-1
$ grep --no-filename 'GitCommit:' -- library/* | cut -d: -f2 | xargs -n1 | sort -u | grep -vE '^.{40}$'
$ bashbrew --library library cat --all > /dev/null
$ 

[whalelines]

Doubly good to also eliminate the possibility of supplying a one-character hash