feat: check checksums when downloading tools from json

[sbouchet]

we should validate any content downloaded from remote with proper cheksum validation, in order to iron our tooling.