"kpm restore" verify SHA values before unpacking

parent #399 

Now can do `kpm restore --config global.json` (`global.json` contains expected SHA values).
If the SHA value of a downloaded package doesn't match the expected SHA in `global.json`, it prints a warning in red and skips installation of this package.
If the expected SHA value of a downloaded package doesn't exist in `global.json`, it prints a warning in yellow and installs this package.
Add Oxford comma (`... project.json, or a ...`).