Support vendored dependencies
Gemnasium only support packages declared in dependency files. By extension, Dependency Scanning does not support vendored dependencies.
To recognize a package vendored in a project, a checksum (sha) must be generated from the source files of the package. For compiled languages like Java, we need to store the checksum of jars, so we need a way to get that information.
This is also needed for gitlab-org/gitlab-ee#2592