[FEATURE/SECURITY/BUG] Add hash key validation to check the files downloaded from external projects

[acassis]

Description / Steps to reproduce the issue

Currently all external projects are downloaded/compiled without checking if their MD5/SHA are valid, so if their content get modified we will not know, ie:

LVGL_UNPACKNAME = lvgl
UNPACK ?= unzip -o $(if $(V),,-q)
CURL ?= curl -L -O $(if $(V),,-Ss)

LVGL_UNPACKDIR = $(WD)/$(LVGL_UNPACKNAME)

$(LVGL_TARBALL):
$(ECHO_BEGIN)"Downloading: $(LVGL_TARBALL)"
$(Q) $(CURL) $(CONFIG_GRAPH_LVGL_URL)/$(LVGL_TARBALL)
$(ECHO_END)

$(LVGL_UNPACKNAME): $(LVGL_TARBALL)
$(ECHO_BEGIN)"Unpacking: $(LVGL_TARBALL) -> $(LVGL_UNPACKNAME)"
$(Q) $(UNPACK) $(LVGL_TARBALL)
$(Q) mv lvgl-$(LVGL_VERSION) $(LVGL_UNPACKNAME)
$(Q) touch $(LVGL_UNPACKNAME)
$(ECHO_END)

On which OS does this issue occur?

[OS: Linux]

What is the version of your OS?

Ubuntu 24.04

NuttX Version

mainline

Issue Architecture

[Arch: all]

Issue Area

[Area: Examples]

Host information

No response

Verification

• I have verified before submitting the report.