tl: add verify-digest subcommand

[philips]

Problem: I want to verify the digest matches the stored digest in the transparency log but I don’t have the asset on disk so tl verify can’t be used.

Potential Usage:

tl verify-digest https://example.com/file.tar.gz b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

Open questions:

• What format should we default to for the digest? hex encoded from sha256sum util or base64 encoded from the transparency log server?
• What should the flag be for switching between input format? —digest-format=hex?