Safer metapackage handling.

Determining whether a package is or is not a metapackage is now done by
checking for its SHA-1 digest. If a SHA-1 digest is provided, it is
considered to be a regular package. If no SHA-1 is provided, it is
treated as a metapackage, since Craft interprets that as the package
having no file.