sources with both branch and tag should be rejected

see also:
https://github.com/managarm/bootstrap-managarm/commit/0e9f9c33fddd585565da023536f6c4dcf1f6b3e5

specifying both is ambiguous, and hence, should fail