Use newer Boost version and verify hash.

Use a specific OpenVPN version (2.3.5) so the build is normalized.

This closes #6296 and #6297.
> http://sourceforge.net/projects/boost/files/boost-binaries/1.57.0/SHA256SUMS.asc/download
> isn't it better to parse the SHA256SUMS[.asc] , and check the signature of the release manager?

That sha/asc is provided only for the binaries. For the code the only thing we have right now is the md5. I've filed an issue for that, see https://leap.se/code/issues/6296