fetch-package: always verify cached packages

The fetch-package script has a bug where a corrupt package marked as
BAD on one run will be seen as OK on subsequent runs.  The problem is
on subsequent runs the script only checks for the presence of the
package, but not the checksum.

This patch makes fetch-package validate the checksum in all cases.  If
the package already exists only the download is skipped, but the
cached package is still validated.
package mirror: use http://mirror.opencompute.org/onie

Fixes #9

This patch changes the default package mirror to
http://mirror.opencompute.org/onie.

Testing Done:

From a clean build tree (the build directory was completely empty)
built the kvm_x86_64 machine and fsl_p2020rdbpca (PowerPC) machines.