Build shairport-sync 4.3.7 from its tag

The task passed the script `${shairport_sync_version}` - shell syntax in a Jinja field,
and the wrong variable name - which the Pi's shell expanded to nothing, so the script
fell back to its own default. Its `git reset` then ran outside the fresh clone, failed,
and was ignored without `set -e`: every build was simply upstream master. The script
now takes `pi_shairport_sync_version`, requires the argument, clones that tag directly
and stops on the first error. Bumped to 4.3.7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/pi_shairport/tasks/main.yml

@@ -12,7 +12,7 @@
           'libavahi-client-dev', 'libssl-dev', 'libsoxr-dev']
          + (['systemd-dev'] if ansible_facts.distribution_major_version | int >= 13 else []) }}
 - name: Build and Install Shairport sync (may take a while)
-  ansible.builtin.script: "build-shairport-sync.sh ${shairport_sync_version}"
+  ansible.builtin.script: "build-shairport-sync.sh {{ pi_shairport_sync_version }}"
   args:
     # The unit file rather than the binary: make install puts the binary in place
     # first, so a build that failed halfway would otherwise never be retried.