Possibly add a hook/check for externally provided checksums, on the fly

[fgeorgatos]

this came up during discussion of --inject-checksum feature and the idea is to cross-check with the repo of reference for validity (fi. a test build should not become green before local easyconfigs and repo align);

here's an example JSON format for the case of artifactory, but the concept should be generic:
https://www.jfrog.com/confluence/display/RTF/Artifactory+REST+API#ArtifactoryRESTAPI-FileInfo

We'd need to catch discrepancies with binary repositories early on, before commiting in git any build(set)
and some automation hook would help.