add support for SHA2 in the curl plugin

[oconnor663]

We will always be totally reliant on git internally, so it's not like we're going to get off of SHA1 anytime soon. But this improvement seems easy enough.

[oconnor663]

This might be higher priority than it seems. My understanding is that the Git developers believe that SHA1 collisions aren't exploitable in Git. But this sort of thing would definitely be exploitable in peru.