Support tarballs

[bycruz]

After #3,

"0.2.0": {
    "archive": "https://example.com/hood-0.2.0.tar.gz",
    "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

[bycruz]

This might actually just be more sustainable to replace the use of git over trying to shoehorn git deps since you ultimately want it to be pinned and the version history is pointless.

It's especially interesting since GitHub, GitLab expose an easy way to get a tarball of a repository.