docker/knot-resolver: check out the correct version from git repo

Before this commit, GIT_SHA was always empty and git checkout would end
up as noop. Now GIT_SHA is properly passed to the command and git
checkout throws on error in case it is empty/non-existent reference.