Emulate GNU ar's deterministic mode

After invoking ar(1), replace each object file's metadata with zero for the mtime, UID and GID, and 0644 for the file mode. Do not touch the existing archive if the contents are the same.

Relevant discussion in #1177; we can probably close the previous attempts in #1410 and #1501.

@nh2 originally wrote this but he disappeared. We would like to see this in production eventually, so I cleaned it up and added more sanity checks.