Add sha256sum (or other) verification to downloaded files

[ts-kris]

Currently, fetch_tar implements downloading the file, if a shasum does not exist, create one from the downloaded file. This is problematic as it would not catch a corrupt (or malicious) download and the whole system would continue to happily use it.

I've implemented a very rudimentary mechanism in fetch_blob that will read an arbitrary file passed to the script and use that as a check file for sha256sum. This works, but is really clunky. Ideally would want to streamline all of the hashing in to a separate process that each fetch_ mechanism could call so its not built in to the fetch_ script itself.