do not bzip2 cdebootstrap.tar

The APK itself is compressed, and the bzip2 file is hard to make
deterministic.
force timestamps of cdebootstrap.tar and contents to that of the .deb

Use the timestamp from the downloaded .deb file to set all of the files and
the .tar file itself to the same timestamp.  This should make the creation
of the .tar file deterministic.  Some setups will extract the
cdebootstrap.deb with different permissions, so also tell tar to try to
keep the permissions as set in the tarball.