Add SHA-1 verification of package contents

MD5 has been proven to be insecure, so it is fairly useless for serving
as the basis of a verification system.

This adds a sha1sum attribute, which is preferentially used if it is available in the package.xml file.  Falls back to md5sum for backwards-compatibility.