When download_core.js is invoked and a local copy of the core extension already exists, the script currently does nothing. That's fine when download_core.js is used as an install script because we expect that directory to be immutable after the install script ran.

Especially when developing on this SDK though, the current behavior can easily lead to situations where the core extension is outdated. This fixes the script to:

1. Generate a sha256 hash for the local file if it exists.
2. Compare that to the expected hash we carry for every core build the script may have to download.
3. Only skip downloading the file if the hash matches.
4. (there's also a post-download hash check now, you never know)

To be able to update the expected hashes after update, the script has an update_hashes subcommand that will print all hashes of the current version.