BLD: compute sha256 sums of build artifacts

Using a secure hash allows verifying ther binaries from a gpg signed
README.txt.
MD5 just kept for legacy users who may not be able to obtain a sha256
utility.
Merge pull request #4793 from juliantaylor/sha256-sums

BLD: compute sha256 sums of build artifacts