Verify bzip2 and zlib downloads.

The bzip2 and zlib authors don't provide https links to download
releases.  However, they do provide md5sums for the releases
on their webpages.