Use a hash for -C metadata instead of a string

Use a hash for -C metadata instead of a string

This ends up serving the same purpose, but a critical change is that it
canonicalizes the relevant git url (if one is used) to ensure that the same
package from two slightly different locations is always built the same way.

Sadly I'm not quite sure how to add a test for this as it involves using remote
git urls which are unusable during tests.