mock-hermetic-repo doesn't validate downloaded rpms

[tkopecek]

Script doesn't check that downloaded rpms have correct checksums. For rpm < 5 it would be easy by checking sigmd5 in current lockfile format for rpmv6 it gets comlicated, see my comment #1560 (comment)