Add support for digest validation, possibly

[alexdutton]

This should be for all request bodies (i.e. metadata and packages).

We should wait to see whether it's reasonable to be in the sword spec first though (I'm asking the internet at https://twitter.com/asdutton/status/1222541450522525696)