When POSIXLY_CORRECT is set, GNU tar will add ctime, atime and the PID
of the tar process that created the archive, as pointed out in [1].
To circumvent this, we set the Pax headers manually as recommended, but
we only do this when SOURCE_DATE_EPOCH is set, i.e. reproducible builds
are desired.
[1] https://salsa.debian.org/reproducible-builds/reproducible-website/merge_requests/50/diffs