Enable release immutability

[Sytten]

Immutable releases locks the git tag associated with the release.
While not a full patch for the supply chain attacks it does allow people that use the full version (like 3.2.1) to be protected without having to use a hash.