[concourse] include sha1 in download

[drnic]

Not sure where/how to raise this/nor if its urgent - but if we now need sha1 for bosh-init manifests perhaps concourse's bosh-io-release resource needs to be able to fetch the sha1.

Or if we trust bosh-io-release to download the right tgz do we not need to worry about sha1 verification.

I'll admit to getting confused on the topic of if/when to do download verification; and how to ensure its not hacked as well.