Replace `external` command with hash based pinning

[psakievich]

The external command is designed to constrain the concretizer to say "use this install and only this install from another spack environment". This is to eliminate the option of choice from the concretizer and seems to be the most robust way to ensure the install will get used.

It is also not ideal. Externals are a bit of a necessary evil for spack, and technically we have a database and upstream we could use in this case.

This issue is to explore using an upstream + requires: /<dag hash> to see if we can get the exact same behavior. requires was not a feature when the external command was written.