properly validate reproducible builds

umoci does produce fairly reproducible images, but we should do a pass-through to make sure we aren't accidentally adding any unexpected randomness into our images. I suspect that some obvious sources of randomness are going to be directory listing order (related to the filesystem, operating system, and possibly operating system versions) and anything we store in a Go `map` (such as xattrs?).