consider recipes with :checksum as "secure"

As discussed in #1856.

If the package recipe has a :checksum property no more work is needed:
either the checksum matches in which case we have a trusted version of
the package, or it fails to match (or doesn't have a :compute-checksum
method) so we get an error raised on el-get-post-install.

The implementation turned out quite simple, I almost suspect I missed something. I think I've covered all the possibilities though.

/cc @technomancy