hashes in download directory

[Rod Widdowson]

> I'm agnostic, by the way, about whether SHA-256 or SHA-512 is the right
> answer. I only care that the process is consistent and documented.

Just as a note the sha-256 on the msi is sorta documented at
https://wiki.shibboleth.net/confluence/display/DEV/V3WindowsInstaller (but
only in the example code).  If we do change things that page *will* need to
change.

But I'll come clean that I only generated the sha-256 because that was what
was in the 3.0.0 beta release when I first built the msi.  After that I just
carried on as before (and captured the behaviour into that page).

R