Hash/signature verification in build-osx-libs.sh

[historic_bruno]

It's good practice to at least verify hashes of downloaded source files in the automated build process, to confirm they aren't corrupted. Preferably we would also do signature verification where available. Since macOS doesn't ship with GPG, that could be something like an optional --verify[-signatures] flag for those who want to use it (required for releases).