Refactor SCM_Command to pure PHP (no shell_exec)

I.e.

```
  static protected function fetch_tarball($url, $auth = NULL) {
    if ($auth)
      $auth = "-u ${auth}";
    // TODO pure PHP
    return shell_exec("echo -n $(readlink -n -f .)/; curl -sfLJO -w '%{filename_effective}' ${auth} ${url}");
  }
```
