Prefer to SHA1 other than MD5 in third-party downloads

If CMake version is less than 2.8.11, fallback to MD5

@fwalch @jszakmeister