Release a repository archive for consistent checksum

[l46kok]

Per bazel-contrib/SIG-rules-authors#11, the checksum of repository code download archives (https://github.com/google/bazel-common/archive/_COMMIT_.zip) are not stable.

In fact, the checksum was changed earlier today as seen in the above issue, though that change was rolled back. Please consider releasing an archive under /archive/refs/tags/$tag, which its SHA256 value is promised to be stable.

[chaoren]

Maybe we should just use git_repository instead of http_archive in the README? We don't currently do fixed releases here, so I'm not sure we want to start promising them.

[l46kok]

git_repository is unideal in many circumstances, since it doesn't support repository caching and it requires downstream users to have git installed (especially problematic for CI / docker container builds). The Bazel team also recommends using http_archive instead.