storage: download integrity check

### Do not merge
- [ ] integrity tests

Picking up from #299, where we're implementing integrity checks for uploads.
We can't assume that the metadata returned from before or after the media download is correct for the actual object downloaded, so we should use the hash value in the request headers.