distro: set the repository checksum dynamically

Instead of having a static repository checksum, set it dynamically from
the metadata that osbuild-composer last saw. This is implemented in
dnf-json, which returns the checksums for each repository on every call.

This enables the use of repositories that change over time, such as
fedora-updates. Note that the osbuild pipeline will break when such a
repository changes. This is intentional: pipelines have to be
reproducible.

test/cases/openstack_empty_blueprint.json

@@ -2,6 +2,9 @@
   "compose": {
     "distro": "fedora-30",
     "arch": "x86_64",
+    "checksums": {
+      "fedora": "sha256:9f596e18f585bee30ac41c11fb11a83ed6b11d5b341c1cb56ca4015d7717cb97"
+    },
     "output-format": "openstack",
     "filename": "image.qcow2",
     "blueprint": {}