Validate checksum before consuming golang-with-libgit2 artefacts

[pjbgf]

The golang-with-libgit2 project has recently started providing signed releases for its artefacts.

The current logic needs to be updated to add said validation:

image-automation-controller/hack/install-libraries.sh

Line 49 in c48f0f9

curl -o output.tar.gz -LO "https://github.com/fluxcd/golang-with-libgit2/releases/download/${TAG}/darwin-libs.tar.gz"