fix tar archive reproducibility

[dpc]

In our project produce binary reproducible binaries, and we would like to build, release and sign bundled versions as well.

However currently the resulting files are not reproducible. After some investigation I've narrowed it down to non-deterministic tar invocation.

This PR changes it to something I've found online, and I verified that binaries between two machines produce byte-identical bundled binary.