(RE-250) Make tagged builds immutable

Currently someone can create a local tag and do an uberbuild, and jenkins will
gladly ship the results to the distribution server and overwrite any existing
builds. After we've shipped to production this isn't really an issue because
also we ship to a separate internal target when we ship to production. The
concern is that between when a tagged build is shipped internally and when it
is pulled in and shipped to production it could be overwritten. This commit
sets the immutable flag on the files from a tagged build, which means they
cannot be overwritten.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>