Deprecated SHA-1 is used for checksums

[dholbach]

Found by Ada Logics:

In the storage utility of the source controller checksums on the collected artifacts are calculated using SHA-1. SHA-1 is considered deprecated as collision attacks against SHA-1 are feasible.

Switch from SHA-1 to SHA-2 in checksum calculations.

We want to emphasize here that it is only in the checksum calculation SHA-1 is recommended not to be used. In the HMAC implementation of Flux SHA-1 is still safe to use.

[hiddeco]

Note that this already was changed in e79b573, but may need a backport to land sooner.

[dholbach]

PR in question was #423

[dholbach]

Anyone up for cherry-picking this?