🦺 fix: Force local checksum mode on validate

[LogFlames]

See #1281.

[algomaster99]

As far as I understand, the validate goal would compare the checksum of the dependency in lockfile with the ones on Maven central (remote) or m2 (local). Shouldn't both be enforced for validation?

[LogFlames]

Currently validate uses the check that was used to generate the lockfile. That if, if the lockfile is local it will check against the m2 folder, if the lockfile is remote it will check against maven central.

If you generated the lockfile only using your m2 folder, I think the check also only needs to be local.
However, if you generate the lockfile using remote, the validate check checks that they are the same on maven central. Which (since we must trust maven central) from my understanding they will always be. Thus we want to verify that noone has tampered with our local m2 folder.

Running checks aganist both m2 and central for remote lockfiles could be an alternative. However, I don't what we would catch by running it against remote at all, thus my proposal to only check against m2.