Security: executable archives downloaded over plain HTTP with hash verification disabled (nohash) - MITM code execution

## Security report (responsible disclosure)

### Executable archives fetched over plain HTTP with hash verification disabled (`nohash`) — MITM code execution

**Affected files:**
- `lgsm/modules/core_steamcmd.sh:17-19`
- `lgsm/modules/update_mta.sh:12-13`
- `lgsm/modules/command_install_resources_mta.sh:17-18`

```bash
fn_fetch_file "http://media.steampowered.com/client/steamcmd_linux.tar.gz" "" "" "" "${tmpdir}" "steamcmd_linux.tar.gz" "nochmodx" "norun" "noforce" "nohash"
fn_dl_extract "${tmpdir}" "steamcmd_linux.tar.gz" "${steamcmddir}"
chmod +x "${steamcmddir}/steamcmd.sh"
```

```bash
fn_fetch_file "http://linux.mtasa.com/dl/multitheftauto_linux_x64.tar.gz" ... "force" "nohash"
```

### Chain

`curl -L` over plain HTTP (`core_dl.sh:445`) on first steamcmd install and on MTA updates → `nohash` bypasses `fn_dl_hash` entirely (`core_dl.sh:217`) → archive extracted into `${steamcmddir}` / `${serverfiles}` → `steamcmd.sh` is chmod +x'd and executed by every subsequent update/start; MTA binaries run at server start, and MTA resources execute as Lua inside the game server.

Any network attacker on path (or DNS hijack — no TLS involved) replaces the payload and gets **shell execution as the LinuxGSM user**, re-triggered automatically by update crons.

### Severity

High — unauthenticated network position → persistent code execution.

### Suggested fix

Serve both URLs over HTTPS (both hosts support it), and pin sha256 checksums the way `install_server_files.sh` already does for its tarballs. The existing MD5 pinning there is better than nothing but sha256 would be the modern baseline.

Start with the affected call sites in lgsm/modules/core_steamcmd.sh, update_mta.sh, and command_install_resources_mta.sh, then read core_dl.sh around lines 217 and 445. Compare the checksum handling in install_server_files.sh. Done means these executable archives use HTTPS and checksum verification before extraction, with the SteamCMD and MTA install or update paths still working.

Written by the indexing model from the issue text.