Check checksums of plugins

[patrickrobrecht]

Verify that the plugin files in the WordPress match the ones in the official WP.org directory to detect compromised files.

There is an official Plugin API endpoint to get the checksums. Sample file: https://downloads.wordpress.org/plugin-checksums/antivirus/1.3.8.json

Original idea by @swissspidy in https://github.com/pluginkollektiv/checksum-verifier/issues/1