ExternalProject: Run `git checkout` with `--` to clarify arguments

Fix the case when the tag name to be checked out also happens to match a
path name.

Fixes: #16678