Add mechanism to mark packages as "hash-clean"
It will likely take some time to migrate all of our tests to work both with SHA1 and SHA256 repositories. We should thus implement a mechanism to mark packages as "hash-clean" so that we can implement a CI job testing against SHA256 that only executes any such marked package.
This both ensures we can easily track progress with regards to what packages still need to be changed and guarantees that our ability to handle SHA256 in already-clean packages doesn't regress.
Edited by Patrick Steinhardt