do not pin repos without releases to exact revisions (#3382)
do not pin repos without releases to exact revisions (#3382)

We're pinning repos without releases because it's very easy to upgrade all the dependencies by executing dep ensure --upgrade. Instead, we should just never run this command directly, only dep ensure --upgrade <some repo>. And we can defend that in PRs.

Refs #3374

The problem with pinning to exact revisions: people who import Tendermint as a library (e.g. abci/types) are stuck with these revisions even though the code they import may not even use them.
tendermint/tendermint,tendermint/tendermint,tendermint/tendermint,tendermint/tendermint