Make the tarball deterministic.
Place the bundle results in their own subdir and hash the results.
Make a deterministic tar wrapper and improve the zip wrappers.

Resulting file permissions inside the archive seem to vary arbitrarily between
build machines, even though we set umask. What's up with that?
Bump Tor Browser source tag to pick up a new Firefox determinism fix.
Gitian builds in VirtualBox with Vagrant