repo: Only apply setuid/xattrs after checksum validation

See the new comment in the source; basically if we're fetching content
over http, then someone with the capability to MITM the network could
create a transient setuid binary on disk with arbitrary content.  If
they also had a process running on the system (such as an application)
it could be escalated to root.

https://bugzilla.gnome.org/show_bug.cgi?id=707139