"kpm restore" verify SHA values before unpacking

parent #399 

Now can do `kpm restore --config global.json` (`global.json` contains expected SHA values).
If the SHA value of a downloaded package doesn't match the expected SHA in `global.json`, it prints a warning in red and skips installation of this package.
If the expected SHA value of a downloaded package doesn't exist in `global.json`, it prints a warning in yellow and installs this package.
No, this condition must be the last one. The logic behind this condition is: if given path is not a directory AND given path is not a project.json file AND given path is not a global.json file AND given path is not null, we throw an exception. It is totally Ok if `argRoot.Value` is `null`. What unacceptable is that `argRoot.Value` is neither `null` nor a valid file path.