add warning about possible checksum verification failure on non-reproducible sources

[lexming]

Verification of checksums can fail for sources of git repos in non-reproducible format (i.e. .tar.gz). This is known, but it can be confusing when those fail as there is no clue that this is the reason:

== FAILED: Installation ended unsuccessfully: Checksum verification for /user/brussel/101/vsc10122/easybuild/install/skylake/sources/p/polars/jsonpath_lib-0.3.0-24eaf0b4416edff38a4d1b6b17bc4b9f3f047b4b.tar.gz using {'jsonpath_lib-0.3.0-24eaf0b4416edff38a4d1b6b17bc4b9f3f047b4b.tar.gz': 'dfb5eb7f47b5b5a7b35262f7b41787a785958001a23ff039cdae926396c6af96'} failed. (took 3 secs)
== Results of the build can be found in the log file(s) /tmp/eb-ubv_m0gz/easybuild-polars-0.20.2-20250306.134946.tPBiI.log
ERROR: Installation of polars-0.20.2-gfbf-2023a.eb failed: "Checksum verification for /user/brussel/101/vsc10122/easybuild/install/skylake/sources/p/polars/jsonpath_lib-0.3.0-24eaf0b4416edff38a4d1b6b17bc4b9f3f047b4b.tar.gz using {'jsonpath_lib-0.3.0-24eaf0b4416edff38a4d1b6b17bc4b9f3f047b4b.tar.gz': 'dfb5eb7f47b5b5a7b35262f7b41787a785958001a23ff039cdae926396c6af96'} failed."

Unfortunately, it is not trivial to add specific information in that error, because at that point the knowledge that the failed tarball is from a git repo is already lost.

So this PR adds a big warning message whenever such a tarball is found in the list of sources.

[boegel]

lgtm