Support marking extension as reproducible when applicable

[cerisier]

Usually I would just mark the extension as reproducible but here it requires a little tweak which I'd wanted to get your thoughts on.

If we were to always mark it as reproducible, we would do so even in the case of a custom prebuilt that has no provided sha256 (because the API allows for empty sha256values).

So I see 2 options:

1. We always mark it as reproducible and expect people to provide a valid sha256values dict.
2. Mark it as reproducible only if there is a matching entry in the sha256values dict.

Regarding 1, I could also make the extension fail() if there is no entry in the dict but so far the API allows for empty values so I thought I'd ask. Regarding 2, I'd then need a way to know if there was a match in buildtools.create_assets so I'd need that function to return if there was a match or not, in which case, I wanted to have your guideline on that (multi return value? something else?)

[keith]

lets change the api to just require shas. i don't think we want to encourage folks to sidestep that and we have the helper to generate them anyways