[WIP] Validating hash when downloading/extracting bundles.

An attempt to validate bundle hashes as they come in the door.  I was able to sha1 hash the file contents as they stream in, avoiding secondary passes over the file contents.

This is a follow on attempt to #32
Cool, looks like this test does properly test ValidatingDigestOutputStream, I was a bit confused because i thought that `HashUtil` was the same code that calculated the hash in both cases, not the case but a bit confusing. Splitting this up into a test utility and digest factory would separate the responsibilities I think.