Validate that archives and local files are not corrupt before using them

When we have a source which is a local file, we make sure the cached
copy in the build tree is identical to the actual source before using it.

When we have a http source we validate the downloaded archive to ensure
it is not corrupt before attempting to use it.

In either case, if the file is not as expected we delete it and retrieve
a fresh copy. This allows us to gracefully recover from corrupt local
files and corrupt http downloads just like we can recover from corrupt
git checkouts.