static-build: use hashes of downloaded files

Using hashes in ExternalProject_Add() [1] allows to avoid extra
downloads on rebuild.

1. https://cmake.org/cmake/help/latest/module/ExternalProject.html

Closes #5761