plugin bundling scripts need to check checksum when downloading

[illume]

Describe the bug

There are some plugin bundling scripts for the app and the container image which download plugins without checking their checksums. The risk is that some files might be corrupted or changed.

Related files:

• build-manifest.json
• app-build-manifest.json
• app/scripts/setup-plugins.js
• container/fetch-plugins.sh

Probably there are other files that call these.

The package command generates a sha256 checksum, so probably we should use that?

We might want to think of this holistically as being part of the publishing process.

Additional Context

Probably this functionality should live in headlamp-plugin. Currently it's in two different scripts.