Feature request: Support saving and checking hash or signature of dependency in report

`dependency-guard` does an awesome job of protecting projects from unwanted dependency changes.

But this way we know nothing about the actual dependency content and cannot protect against malicious supply chain attacks like the ones mentioned here:
- https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications/
- https://blog.sonatype.com/malware-removed-from-maven-central
- https://www.csoonline.com/article/654560/why-open-source-software-supply-chain-attacks-have-tripled-in-a-year.html

Of course, we can use Gradle's support for package signatures. But it's hard to use properly and not supported by many Gradle plugins and library providers (including many Google and JetBrains packages).

By simply saving and checking the dependency package hash along with the package, name, and version, we can verify that this dependency has not been unexpectedly replaced! Using a hashing algorithm like [xxHash](https://xxhash.com/) this would be very fast and provide an order of magnitude higher level of security for any Gradle build with a super simple setup.

Additionally, we can store and check the signature hash for packages that provide one. Using truncated hashes (like for git commits) it will not bloat the dependency reports too much.

All of this can be optional and opt-in, disabled by default.

If this idea is welcome, I would be happy to provide a prototype/mvp pull request.