contrib: use tremor tar.gz

Use the tar.gz and its sha512 checksum instead of a git clone.

Moreover, the referenced sha1 was truncated, so it was subject to
trivial (possibly malicious) collisions.