download: purge cached packages that have incorrect checksum

download: purge cached packages that have incorrect checksum

Before using a package from the cache, verify its size and checksum
against a package index, and delete the package from the cache if they
don't match.  The install process will then proceed to download the
"fixed" package as usual.

This allows to cope with remote packages that are rebuilt while keeping
the same version number as packages in the local cache.  With this change,
any outdated package in the local cache will be purged and the new version
will be downloaded instead.

This is mostly useful when running opkg on the host (e.g. in the
imagebuilder).  When running on a device, no cache is configured by
default, so this change does nothing in that case.

Fixes: FS#2690
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>