Have site generation seek out same-hash artifacts on the Neon update site for source bundles

[jesse-gallagher]

A good chunk of the artifacts in the result update site are, in fact, open source, and could have source bundles included from the Neon site or elsewhere (for some of the older Equinox servlet stuff).

I'll have to check to see if IBM/HCL repackaged them - the hashes may not be the same even if the code is identical or close enough to identical.

[jesse-gallagher]

IBM re-signed the JARs with a different algorithm, so their shasums in the update site won't be identical. Still, the versions largely match what's found in Neon, so it should be safe to grab the source bundles when available.