Allow specifying a checksum of the bin

For security-conscious applications, it'd be nice to be able to add a set of hashes for each `src` that the library checks to make sure the binaries match.

Not sure if this would make more sense as a 4th and 5th arg `src(..., [hash], [hash-method])` or as an entirely new call tacked at the end with a map or array of hashes that correspond to each src.

Start by reading the repository's implementation of the `src(...)` API and how binary sources are handled. Resolve whether checksums belong in the existing arguments or a separate call, then define how supported hash methods, multiple sources, and mismatches should behave. Done means the issue's chosen API verifies each binary against its configured checksum.

Written by the indexing model from the issue text.