add support for unpinned recipes

Even it's something that must not exist in tagged releases, during development there may be some recipes with unpinned versions, i.e. the latest source revision on the git repo is fetched.

In such case, the version is always "git" while the source revision changes.

We should handle also this case because in CI pipelines any kind of new recipe that is added during development must be scanned and reviewed.