Get the sha1 from the file directly, not through its public URI

[baschny]

1. We should not try to fetch an "Public URI" to apply SHA1 to it, as it won't work:

a) if the URI is not reachable (i.e. in Monocle)
b) if PHP does not allow calling "external URIs" in its stream functions (i.e. with open_basedir restriction)

This should make it more robust, but also make it only work with "resources" from our own packages (which is what we intend anyway).

Also fix the URI if it already might contain a query parameter with "?" to use a "&" separator instead.

2. also add the "path" as a cache tag, which allows us to clear a particular cached entry if required.