hit fetch: put the hash first, url second

The hash is the main object that identifies the source code. The url is only
auxiliary to help `hit` download it (if it is not in the source cache) and it
can change.