Track sha2 update to remove deprecated dependency

[emensch]

sha2 depends on a deprecated version of generic_array, which should be resolved when 0.11.0 is released. Once that is available we can remove the #[allow(deprecated)] directive introduced here: #1508