lal verify should verify the checksum of a component

[clux]

This will tell people who are fiddling with INPUT that they are being dodgy.

Work needed:

• extend Lockfile struct with hash string
• checksums added to the lockfile in build (.attach_revision_id(opts.sha) on Lockfile)
• fetch/update should verify lockfile before guaranteeing that a component can be reused
• lal verify --integrity

This will break the "early lockfile" support. Currently the lockfile is created before the build starts because we used to have something that needed it. We can kill this dependency now.