Allow customizing the fields for patches - additional can be okay if justified. If the minimal ones are not there, apply conandata patches will fail (and that should be enough of a check)
For URLs, disallow checksums that are not sha256 moving forward
sha256moving forward