CP-4277: Allow unsigned patches to be installable

This is controlled by the presence of the hotfix file's sha1sum
in the FIST-point "allowed_unsigned_patches".

Duplicate of #1173 for boston-lcm