pull: support Sources.gz without Checksums-Sha256

The Ubuntu development series (stonking) Sources.gz no longer ships a
Checksums-Sha256 field, only Checksums-Sha512 and the legacy Files
(MD5) field. The package_info parser only read Checksums-Sha256, so
the file list ended up empty and fetch_orig_tarball panicked on
Option::unwrap() when looking for the orig tarball.

- Add a ChecksumAlgo enum (Md5/Sha256/Sha512) to FileEntry, replacing
  the hardcoded sha256 field, and parse the strongest available
  checksum field (Sha256 > Sha512 > MD5).
- Make download_file_checksum verify against the correct algorithm
  instead of always using SHA-256.
- Replace the unwrap() on the orig tarball search with a proper error
  listing the available files, so future regressions fail clearly
  instead of panicking.
- Add md-5 dependency for MD5 verification.

Cargo.toml

@@ -17,6 +17,7 @@ regex = "1"
 chrono = "0.4"
 tokio = { version = "1.41.1", features = ["full"] }
 sha2 = "0.10.8"
+md-5 = "0.10"
 hex = "0.4.3"
 log = "0.4.28"
 indicatif = "0.18.3"