Report SHA-256 hash (instead of SHA-1) if checksum is missing.

I accidentally missed this in #2719. Since SHA-256 is the suggested default, the suggested hash if there's one missing should presumably also be SHA-256.

I've checked the repo more thoroughly, and this seems to be the only significant thing missing from #2719 (although a lot of *tests* are still SHA-1).