SHA256 checksums

[Anders F Björklund]

I've now changed the file verification to
check SHA checksums, even when/if MD5 passed.

Before it would skip the stronger hash if
the weaker hash succeded, which seemed wrong.


Where SHA256 is always preferred over SHA(1),
even if it is about* twice as slow (and long).

* If you want to do some timing, there's a
script in "sandbox/hashtime.py" to do it...


In practice, this change only affects aptdeb:
https://bugs.launchpad.net/smart/+bug/522513

There's also a bundled version of SHA256 now,
(from hashlib) for older versions of Python.

--anders