make ./gradlew verify downloaded code before executing it

./gradlew will just download and execute the file in the distributionUrl
without any kind of verification.  This adds verification.

* https://docs.gradle.org/current/userguide/gradle_wrapper.html#sec:verification
* updates should be generated using --gradle-distribution-sha256-sum

gradle/wrapper/gradle-wrapper.properties

@@ -4,3 +4,4 @@ distributionPath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
 distributionUrl=https\://services.gradle.org/distributions/gradle-4.1-all.zip
+distributionSha256Sum=5c07b3bac2209fbc98fb1fdf6fd831f72429cdf8c503807404eae03d8c8099e5