Package: add support for checking fixity

This teaches Packages how to check their own fixity, and report the results. This is currently only supported for bags (which have a record of their own fixity), e.g. AICs or AIPs.

This also adds a new API call which allows external services to request fixity scans and receive a report of the results. The URL is in the format /file/<uuid>/check_fixity/

Note that this fixity scan isn't intended to be 100% authoritative against tampering (since it depends on a manifest file in the same physical location as the files it documents that is not signed), just against data integrity.

refs #6567