font-droid: fix srcs urls

pin urls to a specific commitish, because in the case the font gets
an update hashes will change on the master and therefore break, as
@zimbatm pointed out in #11574.