Make shasum the lowest priority checksum command.

This fixes false "Checksums do not match" errors on systems where shasum
is a symlink to sha256sum or otherwise.