Perform tarsum verification on image pull

Verify the tarsum on pulling images from the registry if
a checksum is provided. The checksums provided by the
registry may be a list, if so, at least one must match.

If the registry does not provide a checksum for an image layer,
the checksum verification is not performed.

Signed-off-by: Eric Windisch <ewindisch@docker.com>