Use official bob.jar release instead of bob-light.jar which is packaged in defoldsdk.zip

In order to simplify the defoldsdk.zip generation (speed, size is 500+mb!), we'd like to use the official bob.jar instead of the one packaged in defoldsdk.zip.
So, when downloading an sdk using a sha1, we should also download the bob.jar separately.

* The crux is finding out _which_ sha1 to use for bob.jar.
* We also don't want to use a bob.jar that is older than the defoldsdk.zip (

The reason it's a crux is that the console sha1 doesn't have a matching bob.jar.
We always refer to the official one.
Will the latest stable one work?

After this step is done, we can remove bob-light.jar from defoldsdk.zip.

Start by tracing the SDK download path that handles a SHA1 and the generation of defoldsdk.zip. Determine how an official bob.jar release can be selected and verified as no older than the SDK, then confirm completion when bob.jar is downloaded separately and bob-light.jar can be removed from the archive.

Written by the indexing model from the issue text.