make reproducible builds

Nobody has claimed this yet.

We need [reproducible builds](https://reproducible-builds.org/) for a security-sensitive application. When I made a test DMG twice in a row I got different results:

```JSON
{
"title": "Test Application",
"contents": [
{ "x": 448, "y": 344, "type": "link", "path": "/Applications" },
{ "x": 192, "y": 344, "type": "file", "path": "Cosmos Voyager.app" }
]
}
```

```
$ appdmg appdmg.json test1.dmg
[ 1/21] Looking for target... [ OK ]
[ 2/21] Reading JSON Specification... [ OK ]
[ 3/21] Parsing JSON Specification... [ OK ]
[ 4/21] Validating JSON Specification... [ OK ]
[ 5/21] Looking for files... [ OK ]
[ 6/21] Calculating size of image... [ OK ]
[ 7/21] Creating temporary image... [ OK ]
[ 8/21] Mounting temporary image... [ OK ]
[ 9/21] Making hidden background folder... [ OK ]
[10/21] Copying background... [SKIP]
[11/21] Reading background dimensions... [SKIP]
[12/21] Copying icon... [SKIP]
[13/21] Setting icon... [SKIP]
[14/21] Creating links... [ OK ]
[15/21] Copying files... [ OK ]
[16/21] Making all the visuals... [ OK ]
[17/21] Blessing image... [ OK ]
[18/21] Unmounting temporary image... [ OK ]
[19/21] Finalizing image... [ OK ]
[20/21] Signing image... [SKIP]
[21/21] Removing temporary image... [ OK ]
[22/21] Removing target image... [ OK ]

Your image is ready:
test1.dmg
$ appdmg appdmg.json test2.dmg
[ 1/21] Looking for target... [ OK ]
[ 2/21] Reading JSON Specification... [ OK ]
[ 3/21] Parsing JSON Specification... [ OK ]
[ 4/21] Validating JSON Specification... [ OK ]
[ 5/21] Looking for files... [ OK ]
[ 6/21] Calculating size of image... [ OK ]
[ 7/21] Creating temporary image... [ OK ]
[ 8/21] Mounting temporary image... [ OK ]
[ 9/21] Making hidden background folder... [ OK ]
[10/21] Copying background... [SKIP]
[11/21] Reading background dimensions... [SKIP]
[12/21] Copying icon... [SKIP]
[13/21] Setting icon... [SKIP]
[14/21] Creating links... [ OK ]
[15/21] Copying files... [ OK ]
[16/21] Making all the visuals... [ OK ]
[17/21] Blessing image... [ OK ]
[18/21] Unmounting temporary image... [ OK ]
[19/21] Finalizing image... [ OK ]
[20/21] Signing image... [SKIP]
[21/21] Removing temporary image... [ OK ]
[22/21] Removing target image... [ OK ]

Your image is ready:
test2.dmg
$ ls -l *.dmg
-rw-r--r--@ 1 david staff 164625813 Aug 29 17:21 test1.dmg
-rw-r--r--@ 1 david staff 164625850 Aug 29 17:30 test2.dmg
```

Start by reproducing the two appdmg commands from the issue and comparing the generated DMGs. The issue names no source file or test, so first trace the appdmg build steps involved in creating and finalizing the image. Done means repeated builds from the same JSON specification produce identical DMG files.

Written by the indexing model from the issue text.