[backend] enforce sha256 for newer rpm-md repositories