Allow specifying custom checksum verification logic

I am using hc-install and terraform-exec and am pleased to see that terraform binary hashes are signed and the signature is checked when downloading terraform binaries.
For supply chain security, I would like to be able to pin expected hashes for terraform binaries (similar to [terraform providers lock](https://developer.hashicorp.com/terraform/cli/commands/providers/lock) and the [dependency lock file](https://developer.hashicorp.com/terraform/language/files/dependency-lock)).

Start by reading hc-install's existing Terraform binary download, signature, and checksum verification flow. Define how callers would provide expected hashes and verify that downloads are rejected when they do not match the configured values; add coverage for the custom verification behavior.

Written by the indexing model from the issue text.