Add a `sha256sums-source` attribute

This would point to the checksums file for a particular release, if available. Currently `add-digests` uses some heuristics to try and find these files (eg. `<path>/<file>.sha256`, `<path>/checksums.txt`, etc.) but this is not scalable to more combinations.

The file would be used only when populating the manifest `sha256sums` table.