Distinguish between checking SHA-1 & SHA-256 sums

A couple casks use SHA-256 checksums. Add language to describe how to
determine those checksums in an easy way.
Merge pull request #2308 from goxberry/contributing-sha256

Distinguish between checking SHA-1 & SHA-256 sums