Add content hashing as a versioning strategy

[jonabc]

closes #129

This PR adds file contents hashing as an alternative versioning strategy for the go and manifest sources.

For the manifest source we already track a specific list of source files that make up the dependency 👍 .

For the go source it's a little more complicated - see the issue for more details - and licensed will hash all files in the import path directory. I took this approach instead of enumerating *Files properties from the go list output to include metadata files (including LICENSE files) if available.

I'm using a pure ruby implementation of the xxHash algorithm via the ruby-xxHash gem. It's not the most recent version of the algorithm (which is xxH3) but it is still much faster than an MD5 hash and should see fewer or equal collisions to that algorithm. For the size of the content in my tests it was significantly faster to use content hashing as it was to obtain the Git SHA.

[jonabc]

content hashing can be enabled with the following setting in a licensed app configuration

version_strategy: contents