Use pub to download package, to have checksum validation of download

[jonasfj]

If the x-goog-hash header is present when downloading a file, we should validate md5 and crc32.

This could help mitigate corrupted downloads, with HTTPS I think this can only happen if the connection is broken is an unfortunate way that leaves the client with a partial download. So checking content-length might be enough -- I'm not sure if we're doing this, from a quick look I couldn't find where it happens. But it's quite possible it does happen somewhere :)

[sigurdm]

We should probably just use pub unpack (when finished) or make a dummy-package depending on the package, and use pub get to download it.

[sigurdm]

Closing as duplicate of #1170