Fix for SPACK-22: Consistent dependency hashing.

The dependency hash wasn't being generated in a consistent way: when
read from .spec file in the install directory, the spec DAG was not
normalized, but when generated on install, it was.  Thus the same
spec can have two possible hashes, which is obviously not good.

In this commit:
- Added a dep_hash function to spec, which should be used to get the
  dependency hash in all cases.  This function normalizes the spec
  before generating the hash.

- removed sha1 functions from Spec and DependencyHash.  The one on
  Spec is not needed and is confusing (it hashed the whole spec, not
  just hash the deps) and the one on DependencyHash wasn't guaranteed
  to be safe because it can't normalize its parent spec before
  hashing.

Hopefully this makes things consistent and easy.