[RFC] Prefer to SHA1 other than MD5 in third-party downloads

If CMake version is less than 2.8.11, fallback to MD5

@fwalch @jszakmeister
It's not a big deal, but you could probably cut down on the repetitiveness here by doing something like this instead:

```cmake
if((DEFINED EXPECTED_SHA1) AND (${CMAKE_VERSION} VERSION_GREATER 2.8.10))
  set(hash_args EXPECTED_HASH SHA1=${EXPECTED_SHA1})
else()
  set(hash_args EXPECTED_MD5 ${EXPECTED_MD5})
endif()

file(DOWNLOAD ${URL} ${file}
  ${timeout_args}
  ${hash_args}
  STATUS status
  LOG log)
```

Note that I haven't tried to run the above code, so there maybe typos or other issues.