[RFC] Let homebrew handle external resources download

@fwalch @tarruda

Close #1388
> It's meaningless for maintenance as you still requires calculating both sha1 and md5 for every updates.

That shouldn't happen too often, and it would be required only in one place (CMake file). If we use SHA1 in Homebrew only, we can't automatically update the formula from the CMake file.

> And it's meaningless for security as an attack can still attack the MD5 users if he/she found a MD5 collision. 

I'm not proposing this for security reasons; still, users of newer CMake versions would be automatically safe(r), while now, everybody is vulnerable to an MD5 collision.