We no longer have a deps/random/*.tar.gz, so don't try to put that into `make source-dist`
Implement hash-checking on downloaded dependencies

Dependencies will be checked at extraction-time, and have their checksums stored
in deps/checksums/. The deps/jlchecksum command tests a given filename against the
checksums stored in that file, supporting MD5 and SHA512 checksums for all
recorded files.  SHA512 is preferred, with MD5 available as a fallback in the
case that `shasum` is not available.  If the hashes do not match, an error is
thrown and compilation is halted.  If a file is asked for and no hash has been
given for that file, the hash is generated for both SHA512 and MD5, and stored
Add an item into NEWS.md
More verbose/user friendly error messages in jlchecksum