BLD: compute sha256 sums of build artifacts

Using a secure hash allows verifying ther binaries from a gpg signed
README.txt.
MD5 just kept for legacy users who may not be able to obtain a sha256
utility.