Do not fetch VCS deps when reference didn't change

[maksbotan]

Pull Request Check List

If we have root -> foo -> VCSDependency(bar, ref="sha256"), and lock file contains bar @ sha256 and user ran poetry lock --no-update, do not fetch bar repo from git: as commit hash is explicitly locked, nothing could have changed.

• [ ] Added tests for changed code.
• [ ] Updated documentation for changed code.

As with #6130, I'll backport this to 1.1 once merged. And I'll need guidance on adding tests.