[RFC] build: allow skipping of the hash check in the download step

This is useful when trying to bisect an issue in a dependency, and we
want to pull from a specific commit but don't want to have to download
and determine the sha1sum and md5sum of the tarball.