build: allow skipping of the hash check in the download step

This is useful when trying to bisect an issue in a dependency, and we
want to pull from a specific commit but don't want to have to download
and determine the sha1sum and md5sum of the tarball.
Merge pull request #1554 from jszakmeister/allow-skipping-of-sum

build: allow skipping of the hash check in the download step