Support pinning remote imports by hash

Cabal 3.8 allows us to use `import: https://www.stackage.org/lts-19.10/cabal.config` inside `cabal.project`.

Someone might be interested in pinning down that file with a cryptographic hash, for security or reproducibility reasons. Perhaps this is a feature worth considering.

The issue identifies remote imports in cabal.project, using https://www.stackage.org/lts-19.10/cabal.config, but names no implementation files or tests. Start by locating Cabal's handling of import URLs and determine the proposed hash syntax and verification behavior. Done requires an agreed design and support for securely pinning the imported file, with coverage for the relevant cases.

Written by the indexing model from the issue text.