Package.extract_file can extract the whole package

Extract_file now takes an optional extract path which defaults to a
temp directory, and omitting the relative path extracts the whole
package.
Package: add support for checking fixity

This teaches Packages how to check their own fixity, and report the
results. This is currently only supported for bags (which have a
record of their own fixity), e.g. AICs or AIPs.

This also adds a new API which allows external services to request
fixity scans and receive a report of the results. The URL is in the
format /file/<uuid>/check_fixity/

refs #6567