Enable force-check-hashes for custom kernels

[troglobit]

I propose we enable the following Buildroot check ...

BR2_DOWNLOAD_FORCE_CHECK_HASHES=y

... and make sure to update patches/linux/linux.hash for every new LTS patch release.

Possibly add this also for U-Boot builds?

[troglobit]

Also update util/kernel-refresh.sh to fetch the hash from kernel.org and update patches/linux/linux.hash