Fix digest handling after 5ae680e49

This adds a sha256_fd() and fd support to rsa_verify(). This allows
passing the temporary fd directly to these functions to check
the signature. sha256_file() is now a wrapper around sha256_fd().
(nop) Use proper order to lseek()
Fix coredump in pkg-add.

Do not double free pkg_inst object.
Only consider a new version of pkg exists if a version has been push in the bulk