Add a `sha256sums-source` attribute

[alecthomas]

This would point to the checksums file for a particular release, if available. Currently add-digests uses some heuristics to try and find these files (eg. <path>/<file>.sha256, <path>/checksums.txt, etc.) but this is not scalable to more combinations.

The file would be used only when populating the manifest sha256sums table.