include/download.mk: generate reproducable SCM tarballs

include/download.mk: generate reproducable SCM tarballs

Apply a number of changes to the tarball generation in order to produce
identical files on different systems:

1) Use an explicit `gzip -cn` to avoid storing file mtime in the gzip header
2) Instruct `tar` to unconditionally use uid and gid 0 for archive members
3) Instruct `tar` to sort archive members by file name
4) For SCMs that do not preserve file modification times like Git or Mercurial,
   use the date of the last commit to the repository and pass it as `--mtime`
   value to `tar`

After these changes, locally produced tarballs generated from SCM checkouts
should be identical on any system, simplifying the mirroring of cache archives.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>