Add a proper support for SOURCE_DATE_EPOCH

[newpavlov]

As far as I understand, right now cargo-deb uses a somewhat peculiar approach to reproducibility. It reads modification time of manifest and then uses it as mtime for files included into control and data tarballs. It was really surprising when I got seemingly reproducible builds at first, but when I reconstructed the build environment from scratch later, I got different package hashes. The problem is that cloning code from a repository sets new mtime for source files, meaning that tarballs will use different mtimes as well.

SOURCE_DATE_EPOCH is the preferred way for achieving reproducibility around timestamps. If it's set, compliant tooling clamps all timestamps included into a package to that time. I think cargo-deb should properly support it instead of the fragile manifest hack as both CLI argument and environmental variable, i.e.:

cargo deb --source-date-epoch 1234
SOURCE_DATE_EPOCH="1234" cargo deb

[newpavlov]

@kornelski Would you be willing to accept an implementation PR or do you have some concerns about the proposed design?