[api] check the verifymd5 instead of the srcmd5 against jobhistory

Also check the now fast lastfailures route for the md5sum first - saving considerable
time in repo checker
[webui] adapt the test suite to Benjamin's latest fixes

It actually verified the broken state before ;(