tools: log and check shasum of archive file
As discussed here, there is the need to log the sha256sum for the external dependencies. With this PR in addition to log the checksum, we also check it's validity and eventually exit with an error. If the check is out of scope, of course I can just leave the log.
I started with nghttp2 and when everything is ok I continue with the other deps