feat: validate content hash for specified versions

[matttrach]

Main Goal

Our org heavily uses GoReleaser in our CI, and due to recent supply chain attacks we are proactively working to improve our security posture. As part of this process we need every downloaded binary to be verified against a known checksum of the file. This is to prevent a poisoned binary from entering our release process.

This change facilitates validating the GoReleaser binary against a known checksum hard coded into this repository.
I have backfilled all checksums from version 0.182.0 forward to give us a starting point. From here we can add the checksum for each new GoReleaser binary as it is released. I have included a script to make this easier.

Solving for Latest

Some users may not have the strict requirements we have, so I have short-circuited the validation when a version isn't pinned. This prevents failures for users who run on latest before the checksum for the latest GoReleaser release has been added here.

I have added tests to validate the functionality and verify that the short circuit is working properly.
I believe that anyone pinning the version of GoReleaser is more than likely concerned with validating the checksum as well.

Extra

I also ran npx depcheck and resolved any errors it found to remove unnecessary dependencies.
I added an exponential backoff with a max of 30sec to the GitHub calls to better handle API latency.

[caarlos0]

hi! thanks for the PR

instead of having the checksums here as well, we should probably use the checksums file from the release and verify its signature to make sure it has not been tampered with. 🤔

[caarlos0]

could also check attestations I think

[caarlos0]

done in #550 - thanks for bringing this up!