RFR: 8369454: Verify checksums of downloaded source bundles when creating devkit [v2]

[Mikael Vidstedt]

> Let's verify that the downloaded source bundles (tar balls) are sound by computing a checksum and verifying against the baked in one.
> 
> This change also introduces a way to provide alternative mirrors for the source bundles, e.g. by setting `GCC_BASE_URL` or `GNU_BASE_URL`.
> 
> Testing:
> 
> * Built devkit on linux-x64
> * Tested that overriding `GNU_BASE_URL` works as expected
> * Verified that the JDK builds with the new devkit

Mikael Vidstedt has updated the pull request incrementally with three additional commits since the last revision:

 - Update DownloadVerify comment
 - Rename DownloadVerify
 - Update make/devkit/Tools.gmk
   
   Co-authored-by: Erik Joelsson <37597443+erikj79 at users.noreply.github.com>

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/27708/files
  - new: https://git.openjdk.org/jdk/pull/27708/files/473bc8a0..bdc5f831

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=27708&range=01
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=27708&range=00-01

  Stats: 3 lines in 1 file changed: 0 ins; 0 del; 3 mod
  Patch: https://git.openjdk.org/jdk/pull/27708.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/27708/head:pull/27708

PR: https://git.openjdk.org/jdk/pull/27708