rpm-spec.mk: check external source tarballs digests with sha1sum. Refs #1646