in order to make builds reproducible.
See https://reproducible-builds.org/ for why this is good
This was suggested by Matthias Clasen as an alternative to MR !3929
The script assumes that the git program is in the PATH which may not be always
the case, so if git was not found, fallback to the former behavior of making
VCS_TAG an empty string if the profile option was not set to 'devel'.
Also fix the call to the script so that we do indeed call GIT on the source GIT
repo so that we can get the right short SHA1 sum.
Re-organize the code a bit in the process, so that things seem cleaner.
The CI pipeline does not do a full clone, so we cannot use `git
rev-parse` to get the short SHA checksum for the current commit.
Of course, since nothing's ever easy, we cannot use vcs_tag() with a
custom command, so we need to generate our out `demo_conf.h` header
straight from a script.
