fix: include checksum in event handler

[ceholden]

What I am changing

This PR updates how we handle finding the Sentinel-2 data checksum when using the "subscriptions" based "link fetcher". When we attempt to download granules that we discover through ESA's Subscriptions API we can begin downloading so quickly that ESA doesn't have the checksum metadata available for the granule. This is OK because the subscription API payload includes the checksum, and this can save us an API request to ESA 🎉.

There are two complications to this that are handled,

1. We still want to be able to search for granules, either for backfills or in case the subscriptions API stops working (completely or partially). The search API doesn't provide the checksum, so the downloader must retrieve it from ESA.
2. We have observed incorrect checksums from ESA that eventually become correct, but sometimes the downloader has to re-retrieve the checksum before ESA provides a correct one. See Tracking incorrect MD5 Checksum errors from Copernicus Data Ecosystem #29 for more on this issue

For more background see this writeup of the trial I ran over the last weekend,
https://github.com/NASA-IMPACT/hls_development/issues/300#issuecomment-2648409964

How I did it

• Update the subscriptions handler to include the checksum in the SQS message and in the database entry
• Update the downloader to only retrieve the checksum from ESA's API when,
  • If the checksum wasn't in the SQS message (because it came from the search API based link fetcher)
  • If the download has been retried, potentially because the checksum was incorrect on the first attempt.
• Along the way I bumped requests to fix a CVE that Dependabot flagged

How you can test it

I updated the unit tests to include,

• [link fetcher] Ensure the checksum exists and is correct when parsing the event subscription payload
• [downloader] Add a missing assert that we called the checksum endpoint in an existing test and add docstring to indicate that this test covers the "search API" based link fetcher
• [downloader] Add a new test to assert that we don't call the checksum endpoint when the checksum is included in the SQS message and we are on our first attempt
• [downloader] Add another test to assert that we ignore the checksum in the SQS message if we're on >=1 attempt (in case it was incorrect from ESA / in case they modified the granule after computing the checksum)

[chuckwondo]

LGTM!