ci: verify a pinned sha256 for every toolchain download (#4098)

Fixes #4079
8 files changed