Use commit sha instead of ref name for module tar

The ref name may include slashes indicating directories
in a filename and as such we would have to pre-created those
which we do not want. The filename does not matter,
thus, the SHA is as good.