Allow server response to override resource's checksum type

Until PUP-1072, all file servers we've interacted with for the file type support returning a checksum based on the checksum type the client provides.

PUP-1072 interacts with HTTP servers, which only return md5 or mtime, and don't support selecting which one. That means the server's response needs to be authoritative for how the client handles the returned checksum. Without a change, files served over HTTP will always resync unless the manifest specifies the same checksum type that server provides.

Having the client override the resource's checksum type based on the server's response seems reasonable, and doesn't seem to violate any security considerations. We might want to keep it an error if the checksum type is explicitly defined, and only override if checksum type wasn't specified; another option might be to provide a new checksum type option that declares the client should always accept the server's response.