Support SHA for downloading artifacts:

So if we also query against SHA, we could actually support SHA.
If there's a branch or tag also named like SHA this could be
ambiguous, but since we could already do that in Git, I think
it's probably fine, people would be aware they shouldn't use
the same name anyway.