Allow multiple known-good hashes for a package.

This works around pip's unpredictable treatment of packages like mock, which provide equivalent zips and tarballs.

This loosens the syntax a bit: now the hash line no longer has to be directly above the requirement line; it can be farther above, as long as the lines between it and the requirement are all comments.

Also remove a redundant inequality test in main().