carl9170: Add and check SHA-256 sums for the toolchain tarballs

The sums for binutils and gcc are based on an HTTPS download (instead
of the default HTTP).

newlib doesn't seem to be available with any kind of signature, so I
compared a tarball and CVS checkout; let's hope they weren't both
compromised.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>