website: document the guest additinos URL and SHA256

/cc @sgirones