[RFC] Let homebrew handle external resources download

@fwalch @tarruda

Close #1388
> @fwalch It's meanless for maintaince or security.

If you have both hashes in there, you can always use SHA1 (for CMake and for automatically updating the Homebrew formula in `bot-ci`), except when the CMake version doesn't support SHA1 (conditional on `CMAKE_MAJOR_VERSION` etc), then you can fall back to MD5.