Verify checksums during downloads

[coryan]

We need to verify the CRC32C checksum during downloads, and signal an error if the checksum does not match the reported object checksum.

We can compute the CRC32C checksum on the fly, but sometimes applications already know what to expect. We should allow applications to provide the expected CRC32C checksum and skip all the computation.

We need to think about MD5 checksums too. These are relatively expensive, and it may be better to only enable them if the application asks.

There are multiple cases where the checksums cannot be computed, including:

• Ranged reads do not have good checksums over HTTP+JSON
• Checksums for objects with decompressive transcoding do not work.