Update CONTRIBUTING to reflect newer style guides

Specify that the SHA-1 checksum shall be used and that the name of the linked
app must be specified via `link`