buildx(build): stabilize pull request git contexts

[crazy-max]

relates to: https://github.com/moby/buildkit/actions/runs/24232318835/job/70813734074#step:7:229

  /usr/bin/docker buildx bake https://github.com/moby/buildkit.git?ref=refs/pull/6681/merge&checksum=d2d23d234e3929fd6095274b5b513e53d9624496 --sbom generator=docker/buildkit-syft-scanner:1.10.0 --print release
  #0 building with "builder-bae940ee-b760-4fca-9703-fe5b5b524d39" instance using docker-container driver
  
  #1 [internal] load git source https://github.com/moby/buildkit.git?ref=refs/pull/6681/merge&checksum=d2d23d234e3929fd6095274b5b513e53d9624496
  #1 0.222 65a519ed3d9d4a67540eeacc72b7f0e966d9fe80	refs/pull/6681/merge
  #1 ERROR: expected checksum to match d2d23d234e3929fd6095274b5b513e53d9624496, got 65a519ed3d9d4a67540eeacc72b7f0e966d9fe80

The gitContext logic now rewrites implicit PR merge refs to github.context.sha and implicit PR head refs to github.context.payload.pull_request.head.sha before building either fragment or query URLs.

BuildKit resolves remote PR refs at build time, so mutable PR refs can drift and no longer match the event commit. actions/checkout avoids that by fetching exact commits into local PR refs, and this change applies the same idea to remote git contexts so the build targets the event commit instead of whatever the PR ref happens to point to later.