Add tar checksum support (SHA-256)

An example usage of TAR_SHA256 in recipe.sh:

VERSION=1.2.15
TAR=https://www.libsdl.org/release/SDL-$VERSION.tar.gz
TAR_SHA256=d6d316a793e5e348155f0dd93b979798933fb98aa1edebcc108829d6474aad00

An example build failure that checksum mismatches could trigger after this change:

repo - fetching sdl
cook - sdl fetch
source.tar: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
./repo.sh failed.mk/filesystem.mk:2: recipe for target 'build/filesystem.bin' failed
make: *** [build/filesystem.bin] Error 1

If you have any plans or better ideas for integrity checking the TAR archives used by the cookbook recipes, feel free to share. I added this new field as optional, could be omitted for development.