Add hash check for setuptools-scm

[EdwardPrentice]

Mandates that the hash for setuptools-scm at version 5.0.2 is correct to avoid tampering

[zenmonkeykstop]

Hi @EdwardPrentice apologies for the delayed response. This is a definite improvement but it may not get used in its current form, as the next release will be Focal-only and hence >Python 3.6, so we can update for that.

[EdwardPrentice]

Sounds good! Gives an idea of how to do it at least!

[conorsch]

Thank you, @EdwardPrentice, for this PR. We just merged #5888 which I believe resolves the concern you raised here—specifically https://github.com/freedomofpress/securedrop/pull/5888/files#diff-8be480111ec0858827980d7f974731ea7c28f24065f7061558ea0464beb4b4d0L7-R7

In that PR, @zenmonkeykstop opted to create a new requirements file, but your trick with the process substitution was clever! Hopefully we'll be able to pare these requirements files down in the near future.

I'm closing this PR as the underlying issue has been resolved, but don't hesitate to re-open if you disagree. Hope to see you around soon!