workflows/release: Make tar archive reproducible

[cgwalters]

This is just a general good practice, but I hit a weird issue where trying to unpack this tarball in a github action failed because we changed ownership to the runner when run as root.

(I didn't test this locally, sorry)

[fdncred]

That whole --pax-option parameter looks a little suspect especially since the docs say --format=gnu would do the same thing. It also seems to require gnu tar of a certain version. I'm not sure what flavor is used in our CI.

This would all need to be tested first, of course.

[devyn]

I think it's very unlikely that this will work on macOS, because the tar there is very limited. It doesn't have most of these options, not even --owner / --group (which would fix your issue)

I suppose we could make sure we're using GNU tar on macOS somehow too. Alternatively, we could switch to using zip files on macOS I guess - for our needs that would be a perfectly okay format.

[cgwalters]

The other alternative to be fully cross-platform is to use tar-rs; it's what I did in cargo vendor-filterer.