"kpm restore" verify SHA values before unpacking

parent #399 

Now can do `kpm restore --config global.json` (`global.json` contains expected SHA values).
If the SHA value of a downloaded package doesn't match the expected SHA in `global.json`, it prints a warning in red and skips installation of this package.
If the expected SHA value of a downloaded package doesn't exist in `global.json`, it prints a warning in yellow and installs this package.
We don't abort the restoring process, although the text in red indicates something is wrong. Think about the error in red "Unable to locate PackageName >= 1.0.0.0" when kpm restore cannot locate a package. They are similar.