include SHA256 checksum in versions

While useful in general, checksums are an absolute _must_ for packaging gems in [NixOS](http://nixos.org/) (see my original issue at https://github.com/rubygems/rubygems.org/issues/712 for more details).

This PR:

* adds a `sha256` column to `versions`
* the hash is strict-base64 encoded ([RFC 4648](http://tools.ietf.org/html/rfc4648))
* the hash is returned in the api queries and is also stored in the index

I will write some tests shortly, but I'm opening this PR now to get feedback as soon as possible.

At a high level, does this seem like a reasonable approach?
Do we really need md5? I realize that it's faster, but we're only summing a few MB, and md5 is a useless choice if we want to use these checksums to detect malicious gem replacement. :/

On Tue, Aug 12, 2014 at 1:13 PM, David Radcliffe <notifications@github.com>
wrote:

>> @@ -1,4 +1,5 @@
>>  require 'vendor/package'
>> +require 'digest/sha2'
> Should you require md5 too?
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/rubygems/rubygems.org/pull/713/files#r16139136