Full source build uses unstable archives

[kpamnany]

This GitHub blog post tells us that byte-for-byte stability of archived source downloads is not guaranteed and recommends downloading release assets instead of using source downloads.

This has bitten us in the past and is also a problem today.

Currently, we use source downloads a lot:

$ grep -R api.github.com deps
deps/openblas.mk:OPENBLAS_TAR_URL = https://api.github.com/repos/xianyi/OpenBLAS/tarball/$1
deps/libwhich.mk:LIBWHICH_TAR_URL = https://api.github.com/repos/vtjnash/libwhich/tarball/$1
deps/libuv.mk:LIBUV_TAR_URL=https://api.github.com/repos/JuliaLang/libuv/tarball/$1
deps/libtracyclient.mk:LIBTRACYCLIENT_TAR_URL=https://api.github.com/repos/wolfpld/tracy/tarball/$1
deps/blastrampoline.mk:BLASTRAMPOLINE_TAR_URL = https://api.github.com/repos/JuliaLinearAlgebra/libblastrampoline/tarball/$1
deps/zlib.mk:ZLIB_TAR_URL = https://api.github.com/repos/madler/zlib/tarball/$1
deps/llvm.mk:LLVM_TAR_URL=https://api.github.com/repos/JuliaLang/llvm-project/tarball/$1
deps/libssh2.mk:LIBSSH2_TAR_URL = https://api.github.com/repos/libssh2/libssh2/tarball/$1
deps/openlibm.mk:OPENLIBM_TAR_URL = https://api.github.com/repos/JuliaMath/openlibm/tarball/$1
deps/libgit2.mk:LIBGIT2_TAR_URL = https://api.github.com/repos/libgit2/libgit2/tarball/$1
deps/ittapi.mk:ITTAPI_TAR_URL = https://api.github.com/repos/intel/ittapi/tarball/$1
deps/JuliaSyntax.version:JULIASYNTAX_TAR_URL = https://api.github.com/repos/JuliaLang/JuliaSyntax.jl/tarball/$1
deps/utf8proc.mk:UTF8PROC_TAR_URL = https://api.github.com/repos/JuliaLang/utf8proc/tarball/$1

Cc: @giordano