Add source tarball artifact to releases

[fredemmott]

GitHub's automatically generated tarballs occasionally change; this makes them unsuitable for pinning as a dependency, as hashes etc can't be used to verify that we're getting what we expect.

This blocks adding watchman as a build-dependency of hhvm

[fredemmott]

Eh, it's not a blocker, just very nice to have: it happens rarely enough that we can temporarily use github's generated tarballs (which AIUI change whenever git archive's behavior changes).

If they change before this is fixed, we'll have to cherrypick new checksums to 8 hhvm release branches, but that's not a blocking amount of effort