sonar: use sha1 instead of md5

Closes #18496.