Use SHA256 for archive.org fallback if SHA1 absent

[HebaruSan]

Motivation

Currently we always calculate both the SHA1 and the SHA256 for all mods. This is redundant and wastes CPU time.

#4135 began the process of making the SHA1 optional; the client now ignores download_hash.sha1 for purposes of validating downloads if download_hash.sha256 is set (which is always). However, it still uses the SHA1 in the archive.org fallback URLs.

Changes

Now if download_hash.sha1 is not set, then the client uses download_hash.sha256 for archive.org fallback URLs instead, as in KSP-CKAN/NetKAN-Infra#344.

This should be the last piece required to make it possible to drop SHA1 from the metadata completely, but note that it will still be calculated for any module with spec_version less than v1.35. We will need to make additional changes later for Netkan to actually stop generating it, and that should wait until most users have updated to clients that can handle it.