Docker: check out packaging tags.

This will ensure we're checking out source code that is close to what we
have in binary packages.

While at it, remove the checkout directory when it's no longer needed.

pkg/docker/template.Dockerfile

@@ -7,9 +7,8 @@ RUN set -ex \
     && apt-get update \
     && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev curl pkg-config \
     && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
-    && hg clone https://hg.nginx.org/unit \
+    && hg clone -u @@VERSION@@-@@PATCHLEVEL@@ https://hg.nginx.org/unit \
     && cd unit \
-    && hg up @@VERSION@@ \
     && NCPU="$(getconf _NPROCESSORS_ONLN)" \
     && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
     && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
@@ -43,6 +42,8 @@ RUN set -ex \
     && ./configure $CONFIGURE_ARGS_MODULES --cc-opt="$CC_OPT" --modulesdir=/usr/lib/unit/modules \
     && ./configure @@CONFIGURE@@ \
     && make -j $NCPU @@INSTALL@@ \
+    && cd \
+    && rm -rf unit \
     && for f in /usr/sbin/unitd /usr/lib/unit/modules/*.unit.so; do \
         ldd $f | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq >> /requirements.apt; \
        done \