Check PKGBUILD exists and matches sha256sum

When adding or updating packages we need to ensure that the package's PKGBUILD sha256sum (in its .BUILDINFO file) matches the one from the upstream repository at the given tag.