Please attach a stable source archive to releases

Releases of Error Prone currently get Git tags and release entries recorded under https://github.com/google/error-prone/releases, but those releases don't have stable source archives attached to them. The only archives offered are via GitHub's automatic tarball endpoints, which are equivalent to running `git archive`.

GitHub does not guarantee that it always returns the exact same bytes for a tarball of a given commit/tag. This can be frustrating for users of Bazel (and similar build tools), which validates downloaded archives against an expected checksum.

Examples of user-reported build breakage that has been caused in the past by GitHub archive checksum changes:

* Protobuf: https://github.com/protocolbuffers/protobuf/issues/3619
* Bazel: https://github.com/bazelbuild/bazel/issues/3722
* Kubernetes: https://github.com/kubernetes/kubernetes/issues/52307

An easy solution is to have the release management script download the auto-generated tarball from GitHub and then upload it as an attachment to the release. That way, if the automatic tarball endpoint's output ever changes (e.g. due to different compression output) the stable archive's checksum will remain the same.

Alternatively, a command such as `git archive --format=tar $TAG | gzip -9 > errorprone-${TAG}.tar.gz` can be used to generate the tarball locally.