Verify bzip2 and zlib downloads.

The bzip2 and zlib authors don't provide https links to download
releases.  However, they do provide md5sums for the releases
on their webpages.
Hi All,

It didn't show up here on the Google Group, but I did push a 2nd patch that 
has a quickie implementation of md5sum written in Go:

https://github.com/jamesgraves/cockroach/commit/4f5eacb0dd7511b475bda9954c7ec94e2e50e177

I thought that if I added it to the PR, there would be an email sent about 
it too, but apparently not.

BR,

James