Cirrus: Test each project for reproducibility

[JeremyRand]

Based on past experience, I don't think anyone at Tor is auditing their intermediate projects for reproducibility. Making Cirrus test these projects' reproducibility would be highly useful.

[JeremyRand]

Basically this could be done by the following logic:

When we check whether an output file already exists (when deciding whether to build it), we also check whether ${OUTPUT_FILE.sha256.1} exists. If we are to build the output file and the sha256.1 file doesn't exist, then we build the output file (this is the first run), and save its hash to the sha256.1 file. If the sha256.1 file does exist, then we build the output file again (this is the second run), and compare the output file's hash to the sha256.1 file. If it matches, we delete the sha256.1 file and proceed as usual to the next project. If it doesn't match, we fail the build (meaning the binary won't get saved to the cache).

Note that the download task will delete any stray sha256.1 files that are leftover, so we can't rely on them being present from previous builds.