reinstate the update.xml hash check

While working on #18912 (moved), Kathy and I discovered the following Mozilla change that causes the update.xml hash check to be skipped when signed MAR files are in use (this change shipped in Firefox 43): https://bugzilla.mozilla.org/show_bug.cgi?id=862173

I think the our philosophy is different than Mozilla's and that we probably want to reinstate the hash check. Mike and Georg, do you agree?

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information