Add an option to verify downloaded JAR by checksum

[aalmiray]

JReleaser publishes a SHA256 checksum for the CLI JAR. Add one extra flag to the command args to define the expected checksum that should match the downloaded artifact.