Package: add support for checking fixity

This teaches Packages how to check their own fixity, and report the
results. This is currently only supported for bags (which have a
record of their own fixity), e.g. AICs or AIPs.

This also adds a new API which allows external services to request
fixity scans and receive a report of the results. The URL is in the
format /file/<uuid>/check_fixity/

refs #6567
Package.extract_file: handle uncompressed packages