Fix some common artifact download bugs

[DrJosh9000]

Description

While investigating the artifact download process a bit more, I discovered some fairly low-hanging fruit in the existing downloader.

Context

Fixes #2774 by making one or another artifact the "winner", and printing a SHA256 sum of the content that it downloaded.

https://coda.io/d/_dHnUHNps1YO#View-3-of-Escalations-Table_tu3KF/r437&view=modal

Changes

• Write to a temp file and move it to the destination name when ready
• Check the error return from Close
• Print a SHA256 sum of the content
• Add ability to verify SHA256 checksum (not yet used)
• Make error strings more Gothic

Testing

• Tests have run locally (with go test ./...). Buildkite employees may check this if the pipeline has run automatically.
• Code is formatted (with go fmt ./...)

[wolfeidau]

Just one query.

[jim-barber-he]

This change has resulted in permissions changes of the artifacts where group and world permissions bits are lost/gone.
It used to use os.Create which combines 0666 with the UMASK, while os.CreateTemp will lock permissions down, since temporary files are only accessible by the user creating them.

This caused an outage for us because our application build doesn't make sure the files have appropriate permissions on them.
See:
https://forum.buildkite.community/t/permissions-on-artifacts-changed-with-version-3-75-0-of-buildkite-agent/3803

[DrJosh9000]

Thanks for pointing this out @jim-barber-he, the permissions change was definitely unintentional. #2894 to fix it should be in the next release.