Update CONTRIBUTING to reflect newer style guides

Specify that the SHA-1 checksum shall be used and that the name of the
linked app must be specified via `link`

closes #293