ExternalProject: Run `git checkout` with `--` to clarify arguments

Fix the case when the tag name to be checked out also happens to match a path name.

Fixes: #16678 (closed)