[Feature]: Digests for URL verification

[ascopes]

Brief description

Be able to provide an optional SHA1/MD5/SHA256 digests, and possibly a GPG signature, in binaryUrlPlugins.

Aims and goals

Improve the stance on security to allow users to detect if their dependencies have changed without them realising.

Workarounds

Store the artifacts in a well-known and trusted registry.

Potential implementation

• New mixin interface similar to OptionalProtocPlugin that exposes fields for SHA1, SHA256, and MD5 hashes that are optional.
• Make the UrlProtocPlugin implement the new interface.
• Add the optional fields to ResolvedProtocPlugin (name them "expectedSha1Digest" or similar to show they are not the computed digests).
• Update BinaryPluginResolver to provide the fields.
• Add new digest methods to Digests.
• Implement a processor class that can consume a ResolvedProtocPlugin and compare the digests, raising an error if the comparison fails.
• Document new fields in AbstractGenerateMojo so that it appears in the documentation.
• Document behaviour in markdown docs.
• Unit tests.
• Integration tests.

[ascopes]

Moved to GH-699.