Default to a safe hash function when computing hashes locally

[I-Al-Istannen]

SHA-1 is deprecated and attacks seem to be becoming more and more feasible. As maven uses SHA-1 hashes for remotes, we are also stuck with this decision when re-using them. However, if we compute hashes ourselves (as we probably should), we can default to a better hash function.

[MartinWitt]

SHA256 should be fine, or do you believe we should already adopt a more robust hash for local hashes?

[I-Al-Istannen]

SHA256 is probably fine and it is widely supported.