Add and Validate NestedInstallerSha256

Description of the new feature / enhancement

Some applications distributed through zip files or other archive types are no longer in active development. In other cases, these installers may not be available from the original publisher, but may still be safe. Although hash collisions are rare in any scenario, a malicious actor with sufficient knowledge of compression algorithms can force a hash collision much easier on an archive type installer than on other types of installers. This creates a scenario where it may be beneficial in some cases, but certainly not all cases, that having and verifying the hash of the nested installer would provide an additional layer of security.

One great example of this is Universal Silent Switch Finder (USSF). The software is no longer under active development and is only available from insecure sites. However, the application is known to be safe with the current hash. Being able to add the nested installer hash for an additional verification would make me as a user feel more secure knowing that both the file being downloaded and the file being installed are being verified.

I am aware of the InstallationMetadata which allows for an optional hash to be supplied for ensuring the install is detected correctly, but this doesn't seem to be related to validation before install.

Proposed technical implementation details

Add an optional NestedInstallerSha256 key, valid when installer type is Zip

Start by locating the existing installer-type validation and the InstallationMetadata handling. Confirm how Zip installers are represented and where pre-install hashes are checked; done means an optional NestedInstallerSha256 is accepted only for Zip installers and validates the nested installer before installation, with coverage for valid and invalid cases.