doc/source/format.rst: Fix misnomer in documentation

The provided example shows the `tar` source ref being
expressed with a `sha256sum` key name, lets make the example
correct here and call it `ref`.