Checksums should be verified for downloaded artifacts #217

Many GitHub releases also publish a checksum file. Sage could, if that file is available, also download it and verify the downloaded artifact against the checksum.

This is useful when downloading over a shaky connection (e.g. train).

An example of a release that also publish a checksum file: https://github.com/golangci/golangci-lint/releases/tag/v1.44.2