Vagrantfile security improvements

Summary:
- Add SHA256 'box_download_checksum' to ensure integrity of boxes after
  downloading them over plaintext HTTP.

- Warn if 'vagrant-rekey-ssh' plugin is missing.

- Try to bind forwarded ports to localhost-only by default.  Note: Some
  (all?) versions of the vmware_fusion provider ignore this setting.

Test Plan: Ran 'vagrant up' on my machine, and looked at the results of 'netstat -tnlp'.

Reviewers: mg, emfree

Reviewed By: emfree

Differential Revision: https://review.inboxapp.com/D373