VCS pinning in pip-compile within pip-finalize.sh

[terrykong]

After #371 , we still need to address VCS installs. These appear in the pip-compiled requirements file in the form of:

clu @ git+https://github.com/google/CommonLoopUtils#egg=clu

The issue is that these will still pull the latest changes from upstream. So to pin them to a particular commit, we can edit the requirements file after pip-compile is run and tack on the SHA to make the entry look like this:

clu @ git+https://github.com/google/CommonLoopUtils@89c2face3474a7482358068d7a00d9bb6e4b31fe

I had a working version of this in this draft PR: https://github.com/NVIDIA/JAX-Toolbox/pull/271/files#diff-8386cfe5c29a3be212a911c9550a56c57420a17cae190b80f60e52c0ce265645R151-R175

At the moment I believe this logic can be added to pip-finalize.sh