Make checksums pluggable

[cstamas]

Maven gone past old way to deal with checksums:
https://maven.apache.org/resolver/about-checksums.html

This means having SHA-1 being the only and only supported is wrong.

Also, see related things in latest resolver like "trusted and provided" checksums... as this somehow correlates with that work (ie target platform can be naturally seen as trusted checksum source).