Lookaside: Move away from md5

[Mathieu Bridon]

We should move to something more secure than md5 for the uploaded sources.

This patch series implements the client-side part of this change.

We might want to drop the md5 fallback once we have migrated completely, that
is when:

1. all archives on the lookaside have been moved to a stronger hash
2. the "sources" file in all git repos has been updated to the same hash

https://fedorahosted.org/rel-eng/ticket/5846