Annotated tags have their own SHA and also point to a SHA in the git
repo. Using git ls-remote $REPO $TAG* the tagged SHAs can be
identified by the '^{}' suffix appended to the corresponding tag name.

When resolving the remote reference, we now search for $TAG* and use
the SHA of the tagged commit (with ^{}) if it is there and otherwise
use the SHA with an exact match for $TAG (to avoid capturing anything
extra via the glob used to return refs).

If no revision is specified, we force 'HEAD' in the git ls-remote call
to constrain what can come back from the remote. Further, we protect
against a badly chosen annotated tag named 'HEAD'.

The functional test suite includes a git bundle of a small example
repo. We found that locally cloning this bundle provided the closest
simulation of `git ls-remote` behavior. YMMV depending on git version.

The test suite could be extended to improve overall coverage, but does
verify the desired behavior for annotated tags.