forc-pkg: source checksums

[kayagokalp]

Currently fetched sources, does not have a mechanism to ensure they are not tampered with. So a user can simply go and change things and create bugs/hard to debug scenerios as forc will not have a way to understand the cache that it is using needs to be invalidated.

We should have a mechanism in hand to check if a fetched source is changed or not. This is related to:

1. git
2. registry (as of feat: registry source resolution and builds #7038)
3. ipfs
   sources.