rustbuild: Verify sha256 of downloaded nightlies

[alexcrichton]

We should be validating our downloads for two reasons:

1. Make sure that the file wasn't corrupted in transit by accident with something like a faulty proxy.
2. Make sure the file itself wasn't tampered with.

To accomplish this let's do two things:

• Check into the compiler Rust source the sha256 of what we should be downloading.
• Check the sha256 of what we just downloaded against this value.

Unfortunately we can't do this in Rust just yet, we'll have to do it in Python or shell out to some system utility. If you've got some Python chops or would like to write a little python, should be a pretty easy bug to get started!

All downloads currently happen in src/bootstrap/bootstrap.py, so this'll just be modifying the relevant pieces there. Feel free to reach out to me if you have questions!

[caipre]

I can take this one as well.

@alexcrichton: The idea here is just to compare the sha256 of the downloaded tarball against the value recorded in the corresponding *.sha256 file from https://static.rust-lang.org, correct? Your first bullet point could be read as though you're suggesting that the hash be committed to the repo as part of the nightly build process.