ramips: mt7621: make haier-sim_wr1800k factory image reproducible

The Build/haier-sim_wr1800k-factory recipe produced non-reproducible images for two reasons:

* openssl aes-256-cbc -salt generates a random salt on every run, which is embedded in the Salted__
  header and feeds key derivation, so identical input yields different ciphertext each build.
* tar -czf embeds the current time in both the gzip header and records member mtimes, uid/gid and
  permission bits taken from the build environment (umask-dependent).

Fix by encrypting with a fixed salt instead of a random one, and by creating the archive with
deterministic tar options (sorted member order, zeroed uid/gid, normalized permissions via
--mode=go-w and mtime pinned to SOURCE_DATE_EPOCH when set (guarded by $(if ...)), piped through
`gzip -n`. The salt "4f70656e57727421" was obtained from `echo -n 'OpenWrt!' | xxd -p`.

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/25605
Signed-off-by: Paul Spooren <mail@aparcar.org>

target/linux/ramips/image/mt7621.mk

@@ -120,8 +120,13 @@ define Build/haier-sim_wr1800k-factory
   mkdir -p "$@.tmp"
   mv "$@" "$@.tmp/UploadBrush-bin.img"
   $(MKHASH) md5 "$@.tmp/UploadBrush-bin.img" | head -c32 > "$@.tmp/check_MD5.txt"
-  $(TAR) -czf "$@.tmp.tgz" -C "$@.tmp" UploadBrush-bin.img check_MD5.txt
-  $(STAGING_DIR_HOST)/bin/openssl aes-256-cbc -e -salt -in "$@.tmp.tgz" -out "$@" -k QiLunSmartWL
+  $(TAR) -C "$@.tmp" \
+	--numeric-owner --owner=0 --group=0 --mode=go-w --sort=name \
+	$(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \
+	-cf - UploadBrush-bin.img check_MD5.txt | gzip -n -9 > "$@.tmp.tgz"
+  $(STAGING_DIR_HOST)/bin/openssl aes-256-cbc -e \
+	-S 4f70656e57727421 \
+	-in "$@.tmp.tgz" -out "$@" -k QiLunSmartWL
   printf %32s $(DEVICE_MODEL) >> "$@"
   rm -rf "$@.tmp" "$@.tmp.tgz"
 endef