[CI]: enforce hash verification for all retrieved artifacts.

### What is the problem you're trying to solve

All network retrieved resources should be verified against a sha (or otherwise pinned to a digest).

### Describe the solution you'd like

This applies to:
- [ ] hack/provisioning helpers, which currently retrieves a variety of binaries
- [ ] windows resources installation
- [ ] kube resources installation
- [x] vagrant provisioning in .github workflow, which does not verify the key it is installing
- [ ] all test images, that are not not using digest pinning
- [ ] in dockerfile:
- [ ] https://raw.githubusercontent.com/AkihiroSuda/containerized-systemd
- [ ] nydus
- [ ] soci