[addons] Fixes retrieval of addon hashes.

Here it->datadir is http://path/to/repo, while addon->Path() is
http://path/to/repo/addon/addon-ver.zip.  We need to check that
addon->Path() is in it->datadir.  Not that they are equal.
[ADDONS|SECURITY] Ensure our zip hasn't been tampered with before rollback.