Add checkGradleChecksum.sh to verify gradle wrapper jars on CI

[ZacSweers]

Followup from the discussion in #433

This adds a CI check to verify the gradle wrapper jar checksum before running any gradle builds, using guidance from https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification

My bash-fu isn't amazing so I'm sure there's a cleaner way to parse the gradle version out of that property file

Successful pass looks like this:

$ ./.ci/checkGradleChecksum.sh    
Checking Gradle wrapper jar for version: 5.6
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100    64  100    64    0     0    127      0 --:--:-- --:--:-- --:--:--   127
gradle-wrapper.jar: OK

Failure looks like this and fails the build:

$ ./.ci/checkGradleChecksum.sh                                                                                                          
Checking Gradle wrapper jar for version: 5.6
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100    64  100    64    0     0    102      0 --:--:-- --:--:-- --:--:--   102
gradle-wrapper2.jar: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
Gradle wrapper failed checksum verification. Please investigate.

[ZacSweers]

In action on CI

[nedtwigg]

Awesome! I'll slowly copy-paste this around my other projects as well, thanks! Might be worth a blog post / discuss.gradle.org post. Nice to have something to just copy-paste.

[ZacSweers]

Yeah and I'm sure it can be improved as well. They do technically have a mechanism to set an expected checksum as a property in that file, but then you have to manually update it every time you update gradle. This felt like a happy medium to always try whatever version your properties script is pinned to