"kpm restore" verify SHA values before unpacking

parent #399 

Now can do `kpm restore --config global.json` (`global.json` contains expected SHA values).
If the SHA value of a downloaded package doesn't match the expected SHA in `global.json`, it prints a warning in red and skips installation of this package.
If the expected SHA value of a downloaded package doesn't exist in `global.json`, it prints a warning in yellow and installs this package.
I think you should do this first. Pretty sure Directory.Exists throws if you pass it a null argument value. Also, it might be ok to throw an ArgumentException - it is an argument after all.