Use HashingInputStream to avoid buffering Payload
Upgrade to Surefire 2.17
JCLOUDS-402: Allow Guava MediaType Content-Type

This promotes type-safety.  Keep the String interface for unknown
content types.
Remove BlobBuilder and Payloads.calculateMD5

Callers should instead explicitly set contentMD5, usually with the
results from Guava Hashing.md5(). This narrows the API and removes a
strange IOException from callers.  Further it removes a dangerous
rebuffering of arbitrarily-large non-repeatable Payloads.
Address Checkstyle violations
Increase timeouts for signed URL tests

Clock skew between the client and blobstore can cause these tests to
spuriously fail.  This commit allows 5 seconds skew in either
direction.