reproducible builds

[jonboulle]

It would be really great if goaci could produce deterministic, reproducible ACI builds from a given snapshot (e.g. git sha) of a particular Go project.

This will require:

• ensuring the actual go build is deterministic and reproducible (discussion here, here)
• deterministic manifest creation (canonical JSON? - this would be nice upstream in appc/spec)
• deterministic tar creation (see, e.g., spec: Reproducible image hashes spec#199)
• not leaking uid/gid of the builder in the aci (see uid/gid of the builder should not leak in the aci #16 )