Verify bzip2 and zlib downloads.

The bzip2 and zlib authors don't provide https links to download
releases.  However, they do provide md5sums for the releases
on their webpages.
md5sum doesn't exist on OSX by default (but it does have `md5` and `openssl md5`, in addition to various scripting languages). What is the most ubiquitous way to compute hashes?

It would also be nice to use a better hash than md5 if one is easily available.